Build 67: Pay over-balance shake, manual slatepacks, green CI, slimmer builds

Pay: stop reddening the amount while typing — requesting more than you hold is
a valid request, so the digits stay black. Pressing Pay without enough funds
now shakes and briefly flashes the amount red and buzzes the phone, then
settles back. Bigger scan-to-pay puck.

Settings: the username "@" moves inside the field as the "@yourname"
placeholder (a leading "@" the user types is stripped). Mixnet routing is
shortened to "All traffic" and flagged in the privacy color. The Build row
links to GitHub releases. Network reads "MW + Nym mixnet + nostr". The Nym
third-party row shows the linked SDK version instead of "socks5".

Wallet: expose GRIM's native by-hand slatepack flow as an advanced
"Slatepacks" page — paste to receive/pay/finalize, or create a payment
slatepack to hand over. The fallback for when a payment can't ride a @username.

CI: fix the red GitHub builds. nym-sdk is a path dep on ../nym, which the
runners didn't have. A composite action materializes the pinned upstream nym
commit plus Goblin's small Android webpki patch before each build; aws-lc-sys
uses prebuilt NASM on native Windows.

Builds: strip release binaries, dropping ~17 MB of debug symbols from the
desktop build.

.github/workflows/build.yml

@@ -1,6 +1,12 @@
 name: Build
 on: [push, pull_request]
 
+# aws-lc-sys (pulled in by nym-sdk) builds AWS-LC, which needs NASM on native
+# Windows. Use the prebuilt NASM objects the crate ships so the runner doesn't
+# need NASM installed; harmless on Linux/macOS.
+env:
+  AWS_LC_SYS_PREBUILT_NASM: 1
+
 jobs:
   linux:
     name: Linux Build
@@ -9,6 +15,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      # nym-sdk is a path dep on ../nym; materialize it before building.
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release
 
@@ -19,9 +27,10 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release
-  
+
   macos:
     name: MacOS Build
     runs-on: macos-latest
@@ -29,5 +38,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release

.github/workflows/release.yml

@@ -23,6 +23,8 @@ permissions:
 
 env:
   TAG: ${{ inputs.tag || github.event.release.tag_name }}
+  # aws-lc-sys (via nym-sdk) needs NASM on native Windows; use its prebuilt NASM.
+  AWS_LC_SYS_PREBUILT_NASM: 1
 
 jobs:
   linux:
@@ -35,6 +37,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -59,6 +62,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -82,6 +86,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build both architectures
         run: |
           export GOBLIN_BUILD="${TAG#build}"