Cardano Updates

Co-authored-by: Copilot Autofix powered by AI <[email protected]>

Remove the comment block above isDraftPullRequest() in
slack-message-broker.yml and the ref-validation comment in
haddock-site.yml.

Quoting "$SCRIPT_REF" stops shell word-splitting but git still parses a
standalone argument starting with '-' as an option (e.g. --upload-pack),
which matters because script_ref comes from a workflow_dispatch input /
github.ref_name and runs on a self-hosted runner.

- Validate the ref against an allowlist (^[A-Za-z0-9_][A-Za-z0-9._/-]*$),
  rejecting leading '-' and stray characters.
- Pass it after --end-of-options on git fetch.
- Use the 'git checkout <tree-ish> -- <path>' form.

Rewrites `PlutusLedgerApi.V1.Data.Value.valueOf` so the non-builtin lookup
path walks the underlying `BuiltinList` directly via `unsafeDataAsMap` /
`unsafeDataAsB` / `unsafeDataAsI`, compares keys with `equalsByteString`,
and short-circuits on the first match. No `Maybe` is materialised: the
"absent" answer is `0`, returned in-place by the `nilCase` of each
traversal. Avoids `withCurrencySymbol`'s continuation + `Map.lookup`'s
`Maybe`-wrapping, and bypasses the `ToData k`/`UnsafeFromData a` dictionary
work that `AssocMap.lookup` does per element. Semantics preserved.

Adds `Spec.Data.Value.test_valueOf`: a QuickCheck property that compiles
`valueOf` via TH, evaluates it on the CEK machine, and compares the result
against the host-Haskell `valueOf` for the same inputs. Differential test
against the Plinth compiler — any divergence is a compilation bug, not a
semantics bug.

Budget evidence (lookup matrix, `unsafeDataAsValue` baseline) lives on the
companion experimental branch `yura/issue-2242-valueof-evidence`, kept out
of this PR to avoid carrying ~96 golden files that would only ever regenerate
on upstream plugin/cost-model changes.

For IntersectMBO/plutus-private#2242.

Move untrusted ${{ github.event.* }} / step-output values out of inline
script and shell bodies and into `env:` blocks, so attacker-controlled
data (workflow/check names, added filenames, refs, etc.) is read as inert
data via process.env / "$VAR" instead of being interpolated into the
source GitHub Actions parses. This closes script-injection vectors, the
most exploitable being the changed-files filename interpolation in
changelog-label.yml.

Files:
- slack-message-broker.yml: read all event fields from env; replace
  toJson(github.event) with JSON.stringify(context.payload).
- changelog-label.yml: read added_files / label flag from env.
- compare-golden-budgets.yaml, docusaurus-site.yml, haddock-site.yml:
  pass event/input values via env and quote shell expansions.

Also fix draft-PR notification filtering in slack-message-broker.yml,
which never worked: the check_run/workflow_run payloads carry only a
minimal PR object with no `draft` field (and the index was wrong), so
detection was always false; a dormant control-flow bug would also have
sent a message on drafts anyway. Now fetch the PR via the API to read its
real draft status (needs pull-requests: read), and suppress the
notification for draft PRs. Fork/push (no PR) and API errors fail open.

The fusion is a constant-factor change, not the elimination of the These
intermediate it was described as. Map.union still produces a per-key These
and the inner These is still built transiently for shared keys; what the
fusion removes is one of the two outer Map.map passes over the post-union
map, plus the wrap-then-remap of single-side currencies. Adjust the
changelog and drop Note [Single-pass unionWith] accordingly; the merge
structure is plain from the code.

For IntersectMBO/plutus-private#2243.

Drop the internal unionVal and checkPred helpers; inline the merge logic
into unionWith and checkBinRel respectively. The previous chain built a
Map CurrencySymbol (Map TokenName (These Integer Integer)) intermediate
via unionVal, then re-walked it to apply f -- three outer passes for a
single conceptual merge.

The fused unionWith now runs Map.union once and a single outer Map.map,
collapsing the These shape inline per currency-symbol entry. The
Map TokenName (These Integer Integer) stage is gone; the outer Map.map
runs once instead of twice. checkBinRel is refactored along the same
shape with Map.union + Map.all, which gives geq / leq / gt / lt
short-circuit termination on the first failing pair.

Adds Spec.Data.Value.test_unionWith: a QuickCheck property that compiles
unionWith via TH, evaluates on the CEK machine, and compares against the
host-Haskell unionWith for the same inputs. Differential test against
the Plinth compiler: any divergence is a compilation bug, not a
semantics bug.

The Spec.Data.Budget gt / geq budget goldens are regenerated: short-circuit
checkBinRel reduces gt4 / geq4 by ~46% (the worst-case adverse input);
other shapes drop 0.7-3% from removing one outer pass over the These
intermediate. The remaining diff is the cost-model anchor; that
component is unrelated to this change.

Budget evidence (union matrix vs builtin, unsafeDataAsValue baseline)
lives on the companion experimental branch
yura/issue-2243-fused-unionwith-evidence, stacked on the sibling
valueOf-evidence branch.

For IntersectMBO/plutus-private#2243.

The previous commit (642442a85f) regenerated the GHC 9.6 column only.
plutus-ledger-api-plugin-test is also buildable on GHC 9.12 per the
ghc-version-support common stanza, and Hydra runs it there; the
checkBinRel rewrite changes the compiled UPLC enough to move the
budgets in both columns. Same regen, run in nix develop .#ghc912.

For IntersectMBO/plutus-private#2243.

Compare the typed unionWith (+) against the builtin unionValue path on
CEK rather than against host-Haskell unionWith: a shared-source oracle
cannot catch a bug that lands the same way on both sides. Inputs are
restricted to the well-formed domain unsafeDataAsValue accepts, and
results are compared up to key order and zero-sum entries. Bindings use
plinthc instead of the compile splice.

Also rephrase Note [Single-pass unionWith] and the checkBinRel docstring
to describe the present structure without contrasting against history.

For IntersectMBO/plutus-private#2243.