[Jimbo4350]

Context

Update the CLI to cardano-api ^>=11.11 from current master (74dd2ced8a0ec0412e8004b2628e6aef3de2f114). Adapt sub-transaction construction to the API's validated TxGuards collection while preserving guard insertion order and existing witness handling.

Use readNodeConfig for debug check-node-configuration: API 11.11 removed the FromJSON NodeConfig instance, and its loader now reads and validates the genesis files and their hashes. Update the configuration tests for the loader's diagnostics and stricter validation, including the Conway cost model fixture. Align the Hackage index with the API release and refresh the Nix inputs.

Draft pending CHaP publication: cardano-api 11.11.0.0 and the network dependency revisions are still open. The CHaP index targets the proposed API release timestamp; refresh the index and CHaP Nix pin after publication, then validate the normal CHaP-only build before merging. Current CI cannot resolve that unpublished index, including jobs that enter the Nix development shell.

How to trust this PR

Validated locally with GHC 9.12.4 against the signed cardano-api-11.11.0.0 release source (76fa5f2d5064d74b25b0ff85318762fb96c97f62):

• cabal build cardano-cli --enable-tests passes with the temporary validation project.
• All 121 CLI tests pass, including node configuration and sub-transaction guard coverage.
• All 829 golden tests pass.
• Fourmolu, HLint, cabal-gild and git diff --check pass for the changed files.

The temporary validation project uses the release source locally, CHaP's latest published index (2026-10-22T14:04:40Z), and the API project's targeted network-bound relaxations for cardano-config, kes-agent and ouroboros-consensus. It also disables external libsodium VRF for the local machine. These local source paths and overrides are not committed. Both test suites used the freshly built CLI via PATH and CARDANO_CLI. This validates source compatibility; it is not yet a successful build against the published CHaP release.

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• Existing tests pass against the release source
• Self-reviewed the diff
• Changelog fragment added in .changes/