Cardano Updates

Bumps the Haskell side onto the dependency set Moog uses for cardano-node 10.7.0:
GHC 9.12.3, ouroboros-consensus 1.0.0.0, cardano-ledger-* on the 1.21.x line,
ouroboros-network 1.1.0.0, typed-protocols 1.2.0.0, and CHaP at index-state
2026-05-22. flake.nix tracks haskellNix 04f3b8ad (it ships ghc9123) with a
top-level hackageNix override; cardano-node moves to 10.7.0; CHaP moves to
the repo-branch commit 8479db77. cabal.project mirrors Moog's constraints block
and disables tests/benchmarks for ouroboros-consensus and ouroboros-network.

The source migration that goes with the bump: cardano-ledger-core 1.19 makes
KeyRole a `type data`, so every `KeyHash '<Role>` tick site loses its data
constructor and must be written without the tick. The signer-witness role flips
from Witness to Guard (the new canonical role for tx-witness signers).
Transaction-building helpers moved out of cardano-node-clients into
cardano-tx-tools (Balance, Build); imports are rewired, `balanceTx` gets the
new refUtxos arg, and `Tx.build` gets `mkPParamsBound` + the refUtxos arg.
`Tx` is now TxLevel-indexed, so a `ConwayTx`/`ConwayTxBody` synonym pair drives
the new spelling across the txbuilder modules. `hashScriptIntegrity` now takes
a `ScriptIntegrity` record. Adds the SRPs the new closure needs
(cardano-tx-tools, cardano-ledger-read, contra-tracer-contrib,
github-release-check, typed-protocols) with allow-newer for the mts:containers
defensive cap.

Tasks: T055-S1

Spec: P1 user story is a Moog maintainer pinning cardano-mpfs-onchain
under the issue-#55 dependency set. Plan: one bisect-safe slice
bumping flake.nix + cabal.project pins and dropping the
'<Role>' tick from every KeyHash site (root cause: KeyRole is
'type data' in cardano-ledger-core 1.19.0.0, so promoted ticks
no longer resolve). Tasks: T055-S1 covers the slice; T055-FIN
covers orchestrator finalization.

Tasks: T000

Tasks: T000