Fix index-sha256 bit rot

If an new package is deployed to `hackage.haskell.org`, to use it before it is captured by the `hackage.nix` update add the following to the project arguments:

```nix
  index-state="2025-06-16T00:00:00Z";  # Use current time here
  # This hash in not valid, the error message will give the correct hash
  index-sha256="sha256-NS28jJYko/tNUKVhncntu/mV8tsQmTA52T000000000=";
```

This change PR fixes some "bit rot" issues:
 * A warning about `--index-state` argument being out of range is now an error.
 * The sha256 might now be in base16 or base32.

Author: hamishmack

lib/call-cabal-project-to-nix.nix

@@ -678,7 +678,7 @@ let
           # Setting the desired `index-state` here in case it is not
           # in the cabal.project file. This will further restrict the
           # packages used by the solver (cached-index-state >= index-state-max).
-          pkgs.lib.optionalString (index-state != null) "--index-state=${index-state}"
+          pkgs.lib.optionalString (index-state != null && index-state < cached-index-state) "--index-state=${index-state}"
         } \
         -w ${
           # We are using `-w` rather than `--with-ghc` here to override

mk-local-hackage-repo/default.nix

@@ -17,7 +17,7 @@
 pkgs:
 { name, index }:
 
-pkgs.buildPackages.runCommand "hackage-repo-${name}" { preferLocalBuild = true; } ''
+pkgs.pkgsBuildBuild.runCommand "hackage-repo-${name}" { preferLocalBuild = true; } ''
 mkdir -p $out
 export expires="4000-01-01T00:00:00Z"
 
@@ -29,7 +29,7 @@ ${
   # of the index derivation (when the `extra-hackages` feature is used the index
   # may not have an outputHash).
   pkgs.lib.optionalString (index ? outputHash) ''
-    if [[ "${index.outputHash}" != "$index_sha256" ]]; then
+    if [[ "$(${pkgs.pkgsBuildBuild.nix}/bin/nix-hash --type sha256 --to-base16 ${index.outputHash})" != "$index_sha256" ]]; then
       echo "ERROR See https://github.com/input-output-hk/haskell.nix/issues/884"
       exit 1
     fi