Cardano Updates

Wire verify-release.yml as a reusable workflow and invoke it from
release.yml after create-release. Add a publish-release job that
un-drafts the GitHub release only once asset smoke-tests pass, and
gate push-docker and update-docs on the same.

verify-release.yml now supports workflow_call and a new
expected-version input so nightly/test releases (whose release tag is
'nightly'/'test') can still verify against the actual build version
printed by the binary.

The `gh release upload` `#<label>` suffix only sets the display label,
not the asset filename, so the docker tarball was published as `result`
(the nix symlink name). Copy the file to the expected name first so the
asset name matches the pattern consumers (and the verify workflow) look
for.

Convert cabal version YYYY.M.D back to release tag vYYYY-MM-DD so the
docker tarball uploaded as a GitHub release asset is internally tagged
to match the release, not the cabal-style version.

The build host runs ~28 GHA runners as a single user against one tmpfs
/tmp, so any job running `rm -rf /tmp/e2e-* /tmp/test-cluster*` on
`if: always()` wipes sibling runners' live VolatileDB files. Under
UTxO-HD (node >= 10.7.0) the consensus layer re-opens these files by
path and crashes with `FsResourceDoesNotExist` instead of tolerating
the unlink via open fd's, which manifested as the Conway Integration
Tests failure on master at 253d290bfd.

Point TMPDIR at \$RUNNER_TEMP — per-job, per-runner, auto-cleaned by
the runner service — so test clusters live in a private directory that
sibling runners cannot touch. Drop the now-redundant (and dangerous)
`rm -rf /tmp/...` cleanup steps from linux-e2e and release. Replace
the shared `/tmp/gha-bench` fixed path in benchmarks with RUNNER_TEMP
for the same reason.

## Summary

- Pin `nixfmt-rfc-style` and `cabal-fmt` in the dev shell so every
contributor and every CI job use the same version of every formatter.
- Add `just fmt` (runs `fourmolu` + `cabal-fmt` + `nixfmt`) and `just
check-fmt` (runs the CI script locally).
- Extend `scripts/ci/check-code-format.sh` so CI actually enforces
`nixfmt` on every tracked `*.nix` file.
- One-time sweep: normalise all `*.nix` with `nixfmt 1.1.0` so the tree
matches what CI now enforces. No semantic changes.
- Document the rule in `CONTRIBUTING.md` and
`docs/.../coding-standards.md`: **no drive-by reformatting.** A style
change and a semantic change must not share a commit, and formatter
switches are out of scope for feature/fix PRs.

## Why

PR #5258 re-formatted `flake.nix` unilaterally with `alejandra`, tucking
the formatter swap inside a 7-line feature. That pattern — mixing style
and semantics, plus changing formatter with no repo-wide decision —
makes diffs unreviewable and `git blame` useless. This PR closes the
loophole: one canonical formatter per language, pinned, CI-enforced,
documented.

## Commits

1. `style: normalise all *.nix files with nixfmt 1.1.0` — the one-time
sweep (1198/954 lines, formatter-only).
2. `chore(nix): pin formatters in dev shell, add just fmt, enforce
nixfmt in CI`.
3. `docs(contributing): pin formatters, ban drive-by reformatting`.

## Test plan

- [x] `just check-fmt` passes on a clean tree.
- [x] `just fmt` is a no-op on a clean tree.
- [x] Each commit individually evaluates the flake (`nix eval
.#cardano-wallet.name`).
- [x] CI green on PR.

Add windowsPackages attribute set built from ucrt64 cross-compilation,
including cardano-cli and cardano-node from cardano-node-runtime hydra
jobs. Expose both staticPackages and windowsPackages in the flake outputs
when the build platform is Linux.

Closes #5253

## Summary

Bump the wallet Nix Haskell projects from `ghc9122` to `ghc9123` and
re-enable `withHoogle` in the dev shell.

The original blocker was a `ghc-9.12.2` panic in the Hoogle/Haddock path
used by the wallet dev shell. Haddock crashed while building docs for
ledger packages (first observed in `cardano-ledger-mary-1.10.0.0`):

- `GHC version 9.12.2: tyConStupidTheta`
- symbol: `SubTx`

`SubTx` comes from ledger's `type data TxLevel = TopTx | SubTx`, so the
failure is a GHC/Haddock bug triggered by promoted/type-level data
constructors during documentation generation.

GHC `9.12.3` release notes include a directly relevant fix:

- `Fixed tyConStupidTheta to handle PromotedDataCon` (`#25739`)

On current `master` the shell workaround for that panic was `withHoogle
= false` in `nix/haskell.nix` (see commit `28a9e5f96a`). This PR bumps
the compiler to `ghc9123` and flips `withHoogle` back to `true`,
restoring in-shell Hoogle.

## What Changed

- `nix/haskell.nix` — `compiler-nix-name = "ghc9123"`, `withHoogle =
true`
- `nix/rewrite-libs/nix/project.nix` — `compiler-nix-name = "ghc9123"`
- `nix/set-git-rev/nix/project.nix` — `compiler-nix-name = "ghc9123"`

Total diff is four lines across three files. No application logic
changed.

## Why These Files

`nix/haskell.nix` controls the main `cardano-wallet` Haskell project and
the default dev shell. The `rewrite-libs` and `set-git-rev` helper
projects also carry their own `compiler-nix-name` pins; leaving them on
`ghc9122` would make the trial internally inconsistent and could hide
unrelated failures.

## Verification

Confirmed locally on the rebased branch (head on top of current
`master`, which already contains the `cardano-node 10.7.1` bump):

- `nix develop` completed with `ghc-9.12.3-env`.
- `withHoogle = true` rebuild produced `hoogle-with-packages.drv` and
`cardano-wallet-shell-env` with no `tyConStupidTheta` panic.
- `hoogle` in the shell resolves to
`…ghc-shell-for-packages-ghc-9.12.3-env/bin/hoogle` (the `withHoogle`
wrapper, not the bare binary).
- `hoogle search --count=3 "Text -> ByteString"` returned live
project-indexed results (`Cardano.Prelude`, `RIO.Prelude`, `RIO.Text`).

That verifies the Hoogle-enabled `nix develop` path that was previously
blocked by the `ghc9122` panic.

## Reviewer Guide

1. Root-cause evidence points upstream to GHC/Haddock, not to ledger or
wallet logic.
2. `9.12.3` has an upstream fix matching the observed panic.
3. Code change is deliberately minimal — four lines, nix-only.
4. Bumping the compiler and flipping `withHoogle` back on are one
logical change: bumping ghc without flipping is dead code in the shell,
and flipping without bumping reintroduces the panic. They ship as a
single commit.

## Follow-up

This PR does not claim Windows validation. If Windows-specific fallout
exists, it should be tracked separately from this narrow shell/Hoogle
unblocker.

cabal 3.16 expects 00-index.tar.gz in local repos but haskell.nix
mkLocalHackageRepo produces 01-index.tar.gz. Create a symlink via
the shellHook.

cabal 3.16 expects 00-index.tar.gz in local repos but haskell.nix
mkLocalHackageRepo produces 01-index.tar.gz. Create a symlink via
the shellHook.