Build 67: Pay over-balance shake, manual slatepacks, green CI, slimmer builds

Pay: stop reddening the amount while typing — requesting more than you hold is
a valid request, so the digits stay black. Pressing Pay without enough funds
now shakes and briefly flashes the amount red and buzzes the phone, then
settles back. Bigger scan-to-pay puck.

Settings: the username "@" moves inside the field as the "@yourname"
placeholder (a leading "@" the user types is stripped). Mixnet routing is
shortened to "All traffic" and flagged in the privacy color. The Build row
links to GitHub releases. Network reads "MW + Nym mixnet + nostr". The Nym
third-party row shows the linked SDK version instead of "socks5".

Wallet: expose GRIM's native by-hand slatepack flow as an advanced
"Slatepacks" page — paste to receive/pay/finalize, or create a payment
slatepack to hand over. The fallback for when a payment can't ride a @username.

CI: fix the red GitHub builds. nym-sdk is a path dep on ../nym, which the
runners didn't have. A composite action materializes the pinned upstream nym
commit plus Goblin's small Android webpki patch before each build; aws-lc-sys
uses prebuilt NASM on native Windows.

Builds: strip release binaries, dropping ~17 MB of debug symbols from the
desktop build.

.github/actions/fetch-nym/action.yml

@@ -0,0 +1,31 @@
+name: Fetch patched nym SDK
+description: >
+  Materialize the nym workspace at ../nym (sibling of the goblin checkout) so the
+  `nym-sdk = { path = "../nym/sdk/rust/nym-sdk" }` dependency resolves. We pin the
+  exact upstream commit Goblin was built against and apply Goblin's small
+  Android webpki-roots patch on top — no separate nym fork to maintain.
+
+runs:
+  using: composite
+  steps:
+    - name: Clone + patch nym
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Upstream nymtech/nym commit Goblin's Cargo.lock was generated against.
+        NYM_SHA=b6eb391e85be7eb8fca62def6d1ac32fd1108c30
+        DEST="$(dirname "$GITHUB_WORKSPACE")/nym"
+        if [ -e "$DEST/sdk/rust/nym-sdk/Cargo.toml" ]; then
+          echo "nym already present at $DEST"
+          exit 0
+        fi
+        rm -rf "$DEST"
+        mkdir -p "$DEST"
+        cd "$DEST"
+        git init -q
+        git remote add origin https://github.com/nymtech/nym.git
+        # Fetch just the pinned commit (GitHub allows reachable-SHA fetches).
+        git fetch -q --depth 1 origin "$NYM_SHA"
+        git checkout -q FETCH_HEAD
+        git apply --whitespace=nowarn "$GITHUB_WORKSPACE/ci/nym-webpki-android.patch"
+        echo "nym materialized at $DEST ($NYM_SHA + Goblin webpki patch)"

.github/workflows/build.yml

@@ -1,6 +1,12 @@
 name: Build
 on: [push, pull_request]
 
+# aws-lc-sys (pulled in by nym-sdk) builds AWS-LC, which needs NASM on native
+# Windows. Use the prebuilt NASM objects the crate ships so the runner doesn't
+# need NASM installed; harmless on Linux/macOS.
+env:
+  AWS_LC_SYS_PREBUILT_NASM: 1
+
 jobs:
   linux:
     name: Linux Build
@@ -9,6 +15,8 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      # nym-sdk is a path dep on ../nym; materialize it before building.
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release
 
@@ -19,9 +27,10 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release
-  
+
   macos:
     name: MacOS Build
     runs-on: macos-latest
@@ -29,5 +38,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Release build
         run: cargo build --release

.github/workflows/release.yml

@@ -23,6 +23,8 @@ permissions:
 
 env:
   TAG: ${{ inputs.tag || github.event.release.tag_name }}
+  # aws-lc-sys (via nym-sdk) needs NASM on native Windows; use its prebuilt NASM.
+  AWS_LC_SYS_PREBUILT_NASM: 1
 
 jobs:
   linux:
@@ -35,6 +37,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -59,6 +62,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
@@ -82,6 +86,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           submodules: recursive
+      - uses: ./.github/actions/fetch-nym
       - name: Build both architectures
         run: |
           export GOBLIN_BUILD="${TAG#build}"