Cardano Updates

## Summary

- The `setGitRev` function uses `set-git-rev` to patch binary content in
Haskell executables, embedding git revision hashes.
- On aarch64-darwin (Apple Silicon), this binary patching invalidates
the ad-hoc code signature that the linker originally created. Apple
Silicon requires all executables to have valid code signatures --
without re-signing, the patched binary is killed on launch.
- This PR uses `darwin.signingUtils` and its `signIfRequired` wrapper
(matching the pattern from cardano-node's `nix/set-git-rev.nix`) to
properly re-sign executables after patching on darwin platforms.

## Changes

In `overlays/haskell-nix-extra/default.nix`:

1. Added `nativeBuildInputs = optionals stdenv.hostPlatform.isDarwin [
buildPackages.darwin.signingUtils ];` to bring `signIfRequired` into
scope (sourced from `buildPackages` to match the
`buildPackages.runCommand` context and support cross-compilation).
2. Added a post-patching loop that calls `signIfRequired` on each
executable to re-sign after `set-git-rev` invalidates the original code
signature.

This is preferable to a raw `/usr/bin/codesign` call because
`darwin.signingUtils` handles signing correctly within the Nix sandbox
and supports both ad-hoc and identity-based signing as needed by the
nixpkgs infrastructure.

## Test plan

- [ ] Build a Haskell package that uses `setGitRev` on aarch64-darwin
and verify the resulting executable runs without code signature errors
- [ ] Verify the fix is a no-op on linux (no codesign invocation, no
`darwin.signingUtils` in `nativeBuildInputs`)

Since newdrv is built with buildPackages.runCommand, nativeBuildInputs
should also come from buildPackages to avoid pulling host-platform
signingUtils into a build-time context during cross-compilation.

On aarch64-darwin (Apple Silicon), all executables must have valid code
signatures. The set-git-rev tool binary-patches executables to embed the
git revision, invalidating the linker's ad-hoc code signature.

Add darwin.signingUtils to nativeBuildInputs and call signIfRequired on
each executable after patching, matching cardano-node's
nix/set-git-rev.nix pattern.

The `set-git-rev` tool uses `Data.FileEmbed.injectWith` to patch binary
content in Haskell executables, embedding the git revision hash. On
aarch64-darwin (Apple Silicon), this binary patching invalidates the
ad-hoc code signature that the linker originally created.

Apple Silicon requires all executables to have valid code signatures.
Without re-signing, the patched binary will be killed immediately on
launch with a code signature validation error.

The fix re-signs the patched executables with an ad-hoc signature using
`/usr/bin/codesign -f -s -` after `set-git-rev` has finished patching.
This is a no-op on non-darwin platforms via `lib.optionalString`.

Copyright: Moritz Angermann <[email protected]>, Input Output Group.