starknet_os: add Rust mirror of the privacy proof-fact fold

[einat-starkware]

Part 1 of 2 of the privacy proof-fact fold stack (OS side of "proving that privacy proofs were verified").

Adds starknet_os::proof_fact_fold, a Rust implementation of the digest chain the proving side builds over privacy-transaction leaf proofs (stwo_run_and_prove_recursive_tree + the multiverifier circuit):

• Leaf digest: blake2s(encode_felt252s_to_u32s(proof_facts[2..])) — drops the proof version and variant markers, keeping [program_hash, ...virtual OS output], exactly the preimage the leaf simple bootloader hashes to its output (which the leaf cairo-verifier circuit emits verbatim as its public output).
• Fold: adjacent entries paired left-to-right; a parent's output digest is blake2s over the children's 32 raw u32 words (circuit_hash ‖ output per child, no felt encoding at fold levels); a trailing unpaired entry is carried unchanged, keeping its own circuit hash; a single-entry block self-folds.
• Verifier output digest: blake2s(circuit_hash ‖ output_digest) of the root entry — what the Cairo circuit verifier's get_verification_output returns.

Tests pin the implementation against golden values from real proven trees on the proving side: the leaf H1 golden and the four_leaves fixture's root output digest.

The circuit hash constants are the canonical_small test-registry values (documented as such); they must be replaced with the production registry's values before production wiring.

Next in the stack: the Cairo0 implementation of the same fold, pinned bit-for-bit against this module.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

---

Generated by Claude Code

[cursor]

PR Summary

Medium Risk
New cryptographic folding logic must stay bit-exact with the prover; wrong constants or hashing would break privacy-proof verification once integrated, though the change is isolated and golden-tested.

Overview
Adds starknet_os::proof_fact_fold, a new library module that computes the same Blake2s digest chain the recursive proving stack uses for privacy-transaction proof facts (leaf hashes from proof_facts[2..], pairwise multiverifier folds, and compute_fold_digest for verifier output).

fold_block_proof_facts turns per-transaction proof facts into a single root FoldEntry; empty transaction lists and proof facts shorter than three felts panic, matching proving-side rules. Leaf and multiverifier circuit hash constants are the canonical_small test-registry values, explicitly marked for replacement before production.

Unit tests lock leaf and four-leaf fold results to proving-side goldens (H1 leaf digest and four_leaves root output). No runner or hint wiring yet—this is the reference implementation ahead of a Cairo mirror.

^{Reviewed by Cursor Bugbot for commit 9b63da8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is