Cardano Updates

  Instead of byte-slicing extended signing keys into normal keys (which
  produces wrong verification key hashes for BIP32-Ed25519), keep them
  native via a CardanoSigningKey sum type and signTxWith helper that
  delegates to the appropriate ShelleyWitnessSigningKey constructor.

  Light wallets (Eternl, Lace, Yoroi) export HD-derived extended keys
  (PaymentExtendedKey — BIP32-Ed25519) which Hydra previously rejected.
  Convert extended keys to normal PaymentKey at load time so users can
  use wallet-exported key files directly with --cardano-signing-key and
  --cardano-verification-key without manual conversion.

The `mithri`l `2617.0` release switched all nodes to static musl builds.
As a side effect, mithril-client-cli is no longer exposed as a
standalone Nix package for non-Linux platforms. It only exists under
`packages.x86_64-linux`. This broke nix develop on `aarch64-darwin`.


The one real downside of current solution is that the fallback pulls in
the entire mithril package (aggregator, signer, end-to-end tooling,
etc.) just to get `mithril-client`.

<!-- Describe your change here -->

---

<!-- Consider each and tick it off one way or the other -->
* [ ] CHANGELOG updated or not needed
* [ ] Documentation updated or not needed
* [ ] Haddocks updated or not needed
* [ ] No new TODOs introduced or explained herafter

---------

Co-authored-by: Noon <[email protected]>

Updates to the latest mithril

`selfci` uses `libc::SYS_pidfd_open` (Linux-only syscall)

I moved `pkgs.selfci` out of the unconditional `buildInputs` and into
the existing Linux-only block

<!-- Describe your change here -->

---

<!-- Consider each and tick it off one way or the other -->
* [ ] CHANGELOG updated or not needed
* [ ] Documentation updated or not needed
* [ ] Haddocks updated or not needed
* [ ] No new TODOs introduced or explained herafter

Signed-off-by: Sasha Bogicevic <[email protected]>

checkPartialFanout now verifies that headInValue equals headOutValue plus the sum of all distributed output values, preventing Ada theft via outputs not counted by the membership proof. The off-chain partialFanoutTx builder is updated accordingly to subtract distributed values from the continuing head output.