Cardano Updates

The treefmt flake check (gofmt + alejandra) gates `nix flake check`. Under the 26.05 toolchain it reports three files: symlink.nix (alejandra reformats the target-switch interpolation block adjacent to the new -lc line), and main.go + registry_test.go (pre-existing gofmt drift — struct-field alignment and a trailing newline — already present at HEAD and unrelated to the upgrade, but required for the treefmt gate to pass). Pure formatting, no behavior change.

httpHeadClient and httpGetClient both use http.DefaultTransport, sharing its connection pool. nix-serve in 26.05 returns a body on HEAD responses (an HTTP violation); Go pools that connection without draining the body, and the next GET reuses it and reads the leftover narinfo body as the status line ("malformed HTTP status code /nix/store/..."). Add headUpstream(), which sets Close: true on upstream HEADs so their connections are never pooled. Kept on DefaultTransport so apitest mocks (which patch DefaultTransport) still intercept.

e2e-test.nix: (1) push via compression=none — spongix only accepts uncompressed NARs and newer Nix compresses uploads by default; (2) Test 4 asserted a 302 redirect, but narinfos have been proxied (200) since d0a3a4f (2026-02-14) so the proxy can rewrite Compression — assert 200 + X-Cache MISS then HIT, with condition-based waiting instead of a fixed sleep.

nixos-26.05 marks minio as insecure (unauth-write CVEs) and abandoned upstream, which broke `nix develop`. minio/minio-client were only used by scripts/run.sh for local S3 simulation, not by the build or tests (the Go code uses the minio-go client library, unaffected).

Replace them with garage in the dev shell. scripts/run.sh was also stale (old CLI flags, no server start); rewrite it to bootstrap a single-node garage S3 and run spongix against it via the current --config JSON interface (store_type s3, signed narinfos). Also fix `nix key generate-secret` to pass --key-name, now required in 26.05.

Zig 0.16 (shipped in nixos-26.05) completed the Io/"Writergate" overhaul: std.os.argv and the cross-platform std.posix.{write,symlink,exit} wrappers were removed, breaking the symlink helper build (only std.os.argv appeared in the error; the posix wrappers fail next).

Rewrite cmd/symlink/main.zig for 0.16: argv now arrives via std.process.Init.Minimal; use raw std.os.linux syscalls on Linux (keeps the ~9 KiB static, libc-free binary) and std.c on macOS, behind a comptime split. symlink.nix links libc only on darwin, where std.c needs it; Linux stays libc-free.

Introduce pkg/narinfox with Open(io.Reader, Signer) -> *Document, the
single gateway every stored/served narinfo passes through. Open parses
once, normalizes Compression/URL to the Spongix wire form, appends the
configured signer's signature when absent, and projects the indexing
keys (NarHash52, StorePathHash, References) from that same parse via
Document.Metadata().

This replaces router.go's rewriteNarinfo plus the parseNarinfoNarHash52,
parseNarinfoStorePathHash, parseNarinfoReferences, and narinfoField
helpers, which re-scanned the bytes once per field. The proxyNarinfo,
largeHeadAndGet, and insert call sites now do one parse and drop their
intermediate io.ReadAll buffers.

main.go holds a narinfox.Signer (nil when no key is configured) instead
of a raw *signature.SecretKey; NewSigner(nil) returns nil so callers
need no guard. Parse-helper tests move into the package; compression_test
keeps a test-only field scanner for asserting raw HTTP response bytes.

Delete the unused cmd/sign standalone signing tool.