Cardano Updates

The alga dependency was missing a sha256 hash, causing repeated warnings
    during nix develop about potential download failures in restricted mode.

    The alga dependency was missing a sha256 hash, causing repeated warnings
    during nix develop about potential download failures in restricted mode.

Bump dompurify resolution from 3.2.4 to 3.3.3 to fix XSS
vulnerabilities (Dependabot alerts #79, #80). Add svgo resolution
at 3.3.3 to fix DoS via entity expansion (alert #81).

Mutation testing on the hand-written Flat instances from #7542 found
9 coverage gaps (none on the on-chain path). Add roundtrip tests for
Tree, Set, PreAligned, PIR Program, SrcSpan, SrcSpans, and
NamedDeBruijn. Remove the dead OVERLAPPING Flat [Char] instance from
Extra.hs — the module was never imported by the umbrella module, so
GHC always resolved Flat String to the generic [a] instance.

The internal flat library contained Generic-based Flat class derivation
via GHC.Generics that had a bug: deserializing large enum types (512+
constructors) consumed infinite memory. While not a security risk (UPLC
on-chain code uses only manual Flat instances), the buggy dead code was
distracting. This commit removes the entire Generic derivation machinery.

Changes:

1. Add manual Flat instances to all types that previously relied on
   Generic defaults: Maybe, Either, Complex, [], NonEmpty, tuples (2-7),
   Tree, Filler, PostAligned, PreAligned, SrcSpan, SrcSpans, and all PIR
   types (Recursivity, Strictness, Datatype, Binding, Program, Term).
   Manual encoding is bit-identical to the Generic encoding.

2. Add missing `size` methods to partial Flat instances in
   FlatInstances.hs (Name, Version, VarDecl, TyVarDecl, Program,
   NamedDeBruijn) and Value.hs (K, Quantity, Value) that previously
   relied on the Generic default for `size`.

3. Gut Class.hs: remove ~440 lines of GFlat*/GEncode*/GSize* classes,
   NumConstructors type family, all Generic default method implementations,
   and associated imports/pragmas/re-exports.

4. Remove ENUM_LARGE test infrastructure (E256/E258 types, Flat/Arbitrary
   instances, ~530 lines) and delete Core.hs inspection tests.

5. Fix transitive import breakage: files that got Generic from the
   PlutusCore.Flat re-export now import GHC.Generics directly.
   Remove `hiding (to)` from imports that no longer re-export Generics.

6. Strip Generic-specific doctests from Tutorial.hs.

All existing tests pass (5281 across 4 suites). Manual instances produce
bit-identical encoding verified by round-trip tests and golden files.

Bump dompurify resolution from 3.2.4 to 3.3.3 to fix XSS
vulnerabilities (Dependabot alerts #79, #80). Add svgo resolution
at 3.3.3 to fix DoS via entity expansion (alert #81).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

verifyEcdsaSecp256k1Signature works on a 33 byte public key not a 32 byte public key.

verifyEcdsaSecp256k1Signature works on a 33 byte public key not a 32 byte public key.