Use paired field passes in GLV affine reductions

[ValarDragon]

Summary

• keep batched affine denominators, inverses, slopes, and final chord products
  in contiguous field-element passes;
• seed the two inversion chains from their first denominators, avoiding two
  multiplications by one per reduction level;
• use paired Montgomery multiplication and back-substitution kernels on Apple
  AArch64; and
• preserve the release-mode fallback to the generic MSM if an exceptional
  zero denominator reaches the optimized reducer.

This is a draft follow-on to #161. Its Apple field kernels intentionally
overlap with #164, which currently lives on the separate CurveFFT stack. The
shared kernel code should be deduplicated when those stacks meet.

Performance

All figures are geometric centers of control/candidate/candidate/control
brackets with one Rayon worker. Lower is better.

Host	MSM terms	Control	Candidate	Change
Linux x86_64	2,150	13.5420 ms	13.3505 ms	-1.41%
Linux x86_64	2,990	17.6400 ms	17.4380 ms	-1.15%
Linux x86_64	5,678	30.1320 ms	29.7920 ms	-1.13%
macOS arm64	2,150	5.1622 ms	5.0177 ms	-2.80%
macOS arm64	2,990	6.7953 ms	6.6232 ms	-2.53%
macOS arm64	5,678	11.6179 ms	11.3135 ms	-2.62%

End-to-end screens:

Host	Workload	Control	Candidate	Change
Linux x86_64	Orchard prover	969.63 ms	963.79 ms	-0.60%
Linux x86_64	Orchard verifier B1	15.633 ms	15.429 ms	-1.31%
Linux x86_64	Orchard verifier B64	96.733 ms	96.205 ms	-0.55%
macOS arm64	Orchard prover	343.83 ms	341.97 ms	-0.54%
macOS arm64	Orchard verifier B1	5.312 ms	5.180 ms	-2.48%
macOS arm64	Orchard verifier B64	36.270 ms	35.478 ms	-2.18%

The macOS prover controls drifted from 340.56 ms to 347.14 ms across the
bracket. Its -0.54% geometric result is therefore screening evidence; the
direct MSM and verifier brackets are the stronger Apple measurements.

The verifier runs reused one authenticated corpus of 64 distinct valid proofs
with SHA-256
3230f733d208a9c905e18db8878234b6a3a4f5b56d1fb92a66a4ad7c2b82adb7.
Every binary validated the complete corpus before timing. Linux end-to-end
figures were pinned to one VM CPU after unpinned B64 samples showed migration
noise; control and candidate used identical affinity.

Validation

• 139 Pasta unit tests and the doc test pass with the glv feature;
• the no-default-features glv,deferred check passes;
• release prover and verifier binaries build and run on Linux x86_64 and
  macOS arm64; and
• optimized MSM differential and exceptional-denominator tests pass.

API surface

No downstream public API changes. The Apple-only implementation adds
crate-internal paired multiplication and batch-inversion back-substitution
helpers for Fp and Fq, plus field-module wrappers used by the sealed GLV
backend.