Cardano Updates

A rejected transaction used to be counted and traced but otherwise
ignored: the run carried on and exited 0 even if every submission was
rejected, so a script could mistake a completely failed run for a
successful one.

Now a rejection makes the run fail, with the strategy depending on the
shape of the stream being submitted. Streams of chained setup
transactions (genesis import, splitting) abort at the first rejection -
everything after it spends outputs that will never exist, so carrying
on would only produce a cascade of confusing follow-up rejections. The
benchmarking phase's NtoM stream consists of mutually independent
transactions, so it is submitted to the end and the action fails
afterwards when the tally shows rejections. Either way the process
exits non-zero, making exit codes trustworthy in scripts.

The strategy is picked in submitInEra from the generator: NtoM (looked
up through Take/Cycle/Sequence wrappers) submits to the end, everything
else aborts at the first rejection.

* Capture the tx-generator exit code with an if/else instead of a bare
  $? after the subshell: under 'set -e' a failure used to abort the
  script on the spot, so the log tails and the exit-code report - the
  part that matters exactly when the run fails - were dead code. (Note
  the 'if ! (...); then TX_EXIT=$?' form would not work either: the
  negation resets $? to 0.)

* Actually fail on functional failure: if no new UTxOs appear at the
  benchmark address the script now exits 1 instead of falling through
  and reporting success. The confirmation window is doubled to 120s -
  in practice inclusion took ~50s, which the previous 60s window only
  just covered.

* Derive the benchmark address from the hardcoded "BenchmarkingDone"
  signing key (cf. keyBenchmarkDone in Compiler.hs) at run time instead
  of hardcoding the bech32 - if the key or the derivation ever changes,
  the test follows instead of silently counting a stale address.

* Default the ogmios flake ref to the repository's master branch
  instead of a personal work-in-progress branch that will rot away;
  a different ref can still be passed as the first argument.

* Use 'find -perm -u+x' in the cabal fallback - the previous '+111' is
  BSD-only syntax that GNU find rejects; '-u+x' works in both.

* Document that debugMode is mandatory alongside ogmiosUrl, silence
  the SC2329 false positive for the trap-only cleanup function on the
  CI-pinned shellcheck, and check for required host commands (nix, jq,
  nc) up front.

Strenghten and polish rough edges of implementation:

* `runScript` now returns `Maybe AsyncBenchmarkControl` instead of
  fabricating a no-op control: submit modes that never start the
  benchmark machinery (LocalSocket, Ogmios) yield Nothing, and a
  failing run no longer dies with the misleading
  "AsyncBenchmarkControl uninitialized" error that masked the real
  one. noopBenchmarkControl is gone; both call sites in Command.hs
  only ever consumed fst, so they are unaffected.

* WebSocket failures (DNS, refused connection, handshake rejection,
  mid-stream drops, close frames) are caught around WS.runClient and
  converted into TxGenError instead of escaping as raw exceptions
  past the error machinery and logging shutdown.

* `parseOgmiosUrl` validates the scheme (plain `ws://` only; `wss://` was
  silently degrading to a plaintext connection), parses the port via
  readMaybe with a 1-65535 range check instead of a partial read
  (`ws://host:/` no longer crashes), and rejects empty hosts.

* Submission responses are subject to a 90s timeout (generous, since
  the node may hold submissions back under mempool pressure) and
  their JSON-RPC id is verified against the request id; a mismatched
  or null id is treated as a protocol fault and aborts the run with
  the offending response described.

* json_highlevel configs that set ogmiosUrl without debugMode: true
  are rejected at compile time with an explanatory error: Ogmios mode
  ignores tps/targetNodes and produces no benchmark metrics, so a
  config asking for a real benchmark must fail fast rather than run
  unpaced and unmeasured. Low-level json scripts are unaffected, and
  compileOptions fails before any node interaction.

* Polish: parseOgmiosUrl/parseOgmiosResponse/OgmiosResult exported to
  make them unit-testable, `fromMaybe Null` instead of `maybe Null id`,
  unused `RankNTypes` pragma dropped, haddock module header added,
  import list put in stylish-haskell order.

The mount-point directories /data, /ipc, /logs were created owned by root.
When a volume was first mounted there, Docker propagated the permissions
from the image, so a container running as non-root could not write.

Apply `chmod g+w` to open up the permissions enough for:

- Kubernetes `runAsUser` (assigns primary group 0 by default)
- Docker `--user <uid>` (assigns primary group 0 by default)
- OpenShift's arbitrary-UID assignment (random UID, GID 0)

For the tracer image, also add `mkdir -p data` and the matching
symlink at `/opt/cardano/data` for parity with the node image's convention.
`run-tracer` defaults `CARDANO_STATE_DIR` to `/data/tracer`
and assumed that this symlink existed. This finally makes that true.
The default state dir now works under non-root
without an explicit `/data` mount.

In response to #6484.

The entrypoints wrote `{{,tracer-}config,topology}-merged.json` to
`/opt/cardano/config/$NETWORK/`, which is image content owned by root.
Non-root containers and read-only-root mounts both fail on this write.

Redirect the writes to `/tmp/cardano-{{,tracer-}config,topology}-merged.json`.

The upstream network config keeps relative refs to genesis /
peer-snapshot files, all resolved relative to the config file's own
directory. Naively moving the merged output to `/tmp` would break those
refs. The jq merge now rewrites them to absolute paths anchored at
`/opt/cardano/config/$NETWORK/`. The key match uses a regex
`(test("GenesisFile$|^CheckpointsFile$"))` so future protocol-era keys
pick up the rewrite without code changes.

Both entrypoints also bail out early with a clear error message if
`/tmp` is not writable, instead of letting the failure cascade into a
less-obvious jq write error.

In response to #6484.

The info banner sat inside the genesis() function body, so it fired once per `wb genesis <op>` dispatch

The info banner sat inside the genesis() function body, so it fired once per `wb genesis <op>` dispatch