apollo_starknet_os_program,starknet_os: add Cairo0 privacy proof-fact fold

[einat-starkware]

Part 2 of 2 of the privacy proof-fact fold stack, on top of #15058.

Adds the OS-side fact fold in Cairo0 (starkware/starknet/core/os/proof_fact_fold.cairo):

• Leaf output digest via encode_felt252s_to_u32s + blake_with_opcode over proof_facts[2..].
• Pairwise fold over raw u32 words with the odd-entry carry rule, and the single-entry self-fold. Entries are contiguous 16-word [circuit_hash, output_digest] blocks, so two adjacent entries are literally the parent digest's 32-word blake preimage — no copying at fold levels.
• compute_fold_digest — the digest the Cairo circuit verifier outputs for the proof whose facts fold to a given entry.
• The leaf-verifier and multiverifier circuit hash constants (canonical_small registry values, documented as placeholders pending the production registry).

The module is not yet reachable from the OS program: it is compiled as a standalone test program under the test_programs feature, so the OS and aggregator program hashes and the bytecode-length pins are unchanged (verified by the existing pin tests). Wiring it into the OS output is deferred to the layering decision (where the block root continues — aggregator vs. a new program).

Tests pin the Cairo implementation bit-for-bit against the Rust mirror from #15058: the self-fold, the carry rule at one and at two layers, deeper trees, the felt-encoding boundaries at 2^63, the fold digest, and the circuit hash constants.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

---

Generated by Claude Code

[cursor]

PR Summary

Medium Risk
Introduces protocol-sensitive Blake2s fold logic and pinned circuit hashes (test registry placeholders); mistakes would break OS vs prover digest agreement once wired in, but production OS behavior is unchanged until integration.

Overview
Adds a Cairo0 OS mirror of the privacy proof-fact fold (proof_fact_fold.cairo) so block-level proof facts can be folded into the same Blake2s digest chain the proving side builds (stwo_run_and_prove_recursive_tree). Leaf digests hash proof_facts[2..] via felt encoding; internal nodes pair adjacent 16-word entries with the odd-entry carry rule and single-entry self-fold; compute_fold_digest matches the circuit verifier’s public output.

The module is compiled as a standalone test program (build hook + PROOF_FACT_FOLD_BYTES) because it is not yet linked into the main OS—program hashes and bytecode pins stay unchanged until wiring is decided.

Tests extend proof_fact_fold_test.rs to execute the compiled Cairo entry points and assert bit-for-bit agreement with the existing Rust starknet_os::proof_fact_fold mirror (leaf digests including 2^63 boundaries, full-block fold for 1–7 txs, fold digest, and canonical_small circuit hash constants).

^{Reviewed by Cursor Bugbot for commit 2573191. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[einat-starkware]

Closing: split into two smaller PRs per review feedback — #15092 (Cairo leaf digest) and #15093 (Cairo fold tree). No content is lost; #15064 is now retargeted onto #15093.

---

Generated by Claude Code