Cardano Updates

Release cardano-api 11.0.0.0

Nixpkgs expects to drop support for intel macs in 26.11.

Fix broken cross-package Haddock links on docs site

Substituting {} directly into the inner sh -c command string would re-parse
URL characters as shell syntax (e.g. an apostrophe in a Haskell module name
like Foo' would terminate the outer single-quoted command). Pass the URL via
sh -c '...' _ {} so it expands as "$1" data instead. Suggested by palas.

Our haddocks are built from cardano-api master against pinned upstream
releases, but the upstream doc sites we link to publish from their own
master. Symbols moved or removed between the pinned release and current
master surface as 404s through no fault of this script. Pointed out by
palas in PR review.

Phase 1's grep scanned every file under WEBSITE_DIR. With --include='*.html'
the scan only considers HTML, avoiding spurious matches against CSS/JS/font
assets and saving wasted work. Suggested by palas in PR review.

Fixes #601. Cross-package hrefs emitted by cabal haddock-project are
relative paths (e.g. href="../cardano-ledger-api-1.2.3-hash/Foo.html")
that don't resolve on the published site — we only host cardano-api's
own output, not its dependencies, so every cross-package reference
404s by default.

Add scripts/fix-haddock-links.sh and wire it into the github-page
workflow between haddock-project and the artifact upload. The script
replaces each cross-package href with either an absolute URL on the
upstream doc site or a tooltip-annotated unclickable <span>, so the
published site has zero clickable 404s.

Pipeline
  Phase 1  Scan filesystem, symlink versioned directories, fetch the
           CHaP index, grep HTML for cross-package link targets.
  Phase 2  For each discovered target, probe candidate doc-site URLs
           and rewrite links (or mark unclickable if unresolvable).
  Phase 2b Rewrite local re-export pages to point at the defining
           upstream package, using Haddock's "Source" cabal-store link
           as ground truth for which package the type lives in.
  Phase 3  HEAD-validate rewritten URLs; rescue dead ones by probing
           doc-site subdirs (api/, protocols/, framework/) and parent
           modules with #t: fragment reconstruction. What can't be
           rescued becomes an annotated <span>.

Doc-site resolution for CHaP packages — two lookups, first hit wins:
  1. Name-suffix heuristic under *.cardano.intersectmbo.org — strip
     trailing '-token' segments of the package name and HEAD-probe
     each candidate's doc-index.html. Covers cardano-ledger-*,
     plutus-*, ouroboros-*, etc.
  2. Fixed fallback against a small IOG_DOC_BASES list — covers
     packages whose subdomain isn't a suffix of the package name
     (e.g. cardano-base at base.cardano.intersectmbo.org).

Non-CHaP packages (bootlibs like base, bytestring, time) are NOT
linked. Haddock's per-module URL structure doesn't line up cleanly
with Hackage's (src/ source views, -inplace version suffixes) so
Hackage rewrites mostly produce 404s, and readers of cardano-api docs
rarely click into bootlib internals. Rendered as unclickable spans,
no outbound link, no validation noise.

Dead-link CI policy
  Actionable (FAILS CI): a CHaP package the probe couldn't resolve to
  any doc site. Usually a gap in IOG_DOC_BASES — fix by adding the
  package's upstream doc base URL or, if genuinely unpublished, adding
  the package to KNOWN_UNDOCUMENTED.

  Unfixable (does NOT fail CI, logged for visibility): module-level
  404s on otherwise-valid upstream sites where upstream only publishes
  umbrella exposed-modules; packages with no published Haddocks
  anywhere; absolute Hackage URLs that lack a package version. All
  outside this repo to fix.

  Escape hatch FIX_HADDOCK_LINKS_ALLOW_DEAD=1 exits 0 even with
  actionable entries; under GitHub Actions, actionable entries emit
  ::warning:: annotations.

Rolling tracking issue
  Post-merge workflow failures on master open or comment on a single
  rolling issue, tagging the PR opener so the breakage lands on
  someone's board instead of going unnoticed. The Deploy step skips on
  failure, so the published site stays at its last good revision until
  the issue is resolved.

Includes a Herald changelog fragment under .changes/.

- Changelog (.changes/.../fix_haddock_links.yml): collapse the
  description block scalar to a single line, removing the hard wraps
  Herald renders verbatim (r3159565460).

- derive_name_candidates (scripts/fix-haddock-links.sh): cap at
  two-token names. The previous loop emitted a single-token URL like
  cardano.cardano.intersectmbo.org as its last candidate; if that
  subdomain ever resolves (wildcard DNS, future deploy, catch-all),
  probe_site silently accepts it and rewrites every cardano-* link to
  the wrong site. Add an early break after the suffix strip so the
  heuristic never emits a URL whose subdomain is a single bare token
  (r3159784338).

- curl retries (scripts/fix-haddock-links.sh): every probe was a
  single-shot attempt (5s connect, 10s max) with no retry. Worst case:
  Phase 3 validation downgrades a perfectly valid rewritten URL into
  an unclickable <span>, silently shipping a regression. Other failure
  modes: probe_site falling through to a wrong candidate, or the CHaP
  index fetch killing the whole build on a CDN hiccup. Add
  --retry 3 --retry-delay 2 --retry-all-errors to all five curl sites
  (r3159784102).

- Workflow assignee 422 (.github/workflows/github-page.yml): the
  GitHub API rejects assignees that aren't repo collaborators with a
  422. If an external contributor merges a PR that breaks the haddock-
  links check on master, the rolling-issue workflow step would crash
  there, leaving the issue or comment half-created. Wrap both
  addAssignees calls in try/catch and remove assignees from the
  issues.create payload, doing assignment as a separate best-effort
  call so the issue always lands (r3159784547).

gRPC: Add searchUtxos method

- Add changelog fragment with single-line description (no hard wraps in
  the YAML block scalar).
- derive_name_candidates: cap at two-token names. The previous loop
  emitted a single-token URL like cardano.cardano.intersectmbo.org as
  its last candidate. If that subdomain ever resolves (wildcard DNS,
  future deploy, catch-all), probe_site would silently accept it and
  rewrite every cardano-* link to the wrong site. An early break after
  the suffix strip prevents the heuristic from ever emitting a URL
  whose subdomain is a single bare token.
- Add --retry 3 --retry-delay 2 --retry-all-errors to all five curl
  sites. Every probe was previously a single-shot attempt (5s connect,
  10s max). Worst case: Phase 3 validation downgrades a perfectly
  valid rewritten URL into an unclickable <span>, silently shipping a
  regression. Other failure modes: probe_site falling through to a
  wrong candidate, or the CHaP index fetch killing the whole build on
  a CDN hiccup.

Two fixes from Copilot's review:

  - HTTP probes now accept 307 and 308 alongside 200/301/302. Modern
    HTTP increasingly uses 307 (temporary, method-preserving) and 308
    (permanent, method-preserving) instead of 302/301; treating them
    as failures could misclassify valid upstream sites as dead. Four
    occurrences updated: probe_site, the Phase 3 main validator, the
    Phase 2b reexport probe, and the Phase 3a rescue probe.

  - Add a Herald changelog fragment under .changes/. The repo enforces
    these via .herald.yml and the existing PR template's YAML block
    isn't a substitute for a tracked file.

Two fixes from Copilot's review:

  - HTTP probes now accept 307 and 308 alongside 200/301/302. Modern
    HTTP increasingly uses 307 (temporary, method-preserving) and 308
    (permanent, method-preserving) instead of 302/301; treating them
    as failures could misclassify valid upstream sites as dead. Four
    occurrences updated: probe_site, the Phase 3 main validator, the
    Phase 2b reexport probe, and the Phase 3a rescue probe.

  - Add a Herald changelog fragment under .changes/. The repo enforces
    these via .herald.yml and the existing PR template's YAML block
    isn't a substitute for a tracked file.

Two intentional changes for end-to-end testing of the new
'Open / update dead-link tracking issue' workflow step:

  A. Remove typed-protocols from IOG_DOC_BASES so the script reports
     it as Actionable Unmapped CHaP and exits 1 deterministically.

  B. Drop the 'github.ref == refs/heads/master' clause from the new
     step's if-gate so the step fires on workflow_dispatch from this
     test branch.

This branch is for validation only and should be deleted after
testing — do NOT merge.