Cardano Updates

Done in two parts:
1. generally, for all tests, but exceptions are fatal to the test
2. specifically for the state machine tests, properly integrated
   so that failure reporting and shrinking work.

Doing 1. properly for all tests would be quite an effort, because it
needs setup and teardown for each test run.

Without it, exceptions from refs that are forgotten before being
released are thrown to the main thread (which interrupts the tests).

This is centered around the notion of singular references, as opposed
to actions to manage a reference count.

Under the hood, a (Ref obj) does manage a reference count within the
obj, but each reference is a single thing. So instead of operations to
increment and decrement reference counts, we have functions to create a
Ref, duplicate a new Ref and release a Ref.

The weak reference API is given similar treatment.

Including the mechanism to check that:
* Refs are not freed more than once
* Refs are not used after being freed
* Refs are not freed less than once

In particular, WBB.removeReference is replaced by releaseRef, and
WBB.addReference by dupRef.

The TableContent and Cursor contain a WriteBufferBlobs, which becomes
a Ref WriteBufferBlobs.

Most of the changes are just replacing Run m h with Ref (Run m h) all
over the place, and replacing Run.removeReference with releaseRef.

The slightly more interesting changes are in the modules Run and
MergeSchedule, where we have to change the style of duplication from
incrementing reference countsto returning new references.

Make NumEntries a monoid for addition.

When we switch Run to use the Ref API, these access functions will avoid
having to make changes at all use sites (using DeRef).

Pass just the necesary fields to the finaliser, rather than passing the
whole Run (which creates an apparent recursive knot).

All use cases provide a finaliser. The new API will require it.

The new API unifies the `Normal` and `Monoidal` APIs, supporting both blob
references and mupserts, and is strictly more expressive. If a user does not
want to use blobs, then the blob type can be set to `Void`. If a user does not
intend to use the full potential of `Mupserts`, then the `ResolveAsFirst`
wrapper provides a sensible default instance for the `ResolveValue` class.

As a preparation for table unions, we need to know how many credits
are left over when supplying them to a MergingRun.
Also, this cleans up the namespace a little before new function are
added.