chore(pasta): fuse AArch64 repeated squaring

[ValarDragon]

Standalone main-targeting version of #240. This cherry-picks only the AArch64 repeated-squaring commit and does not include the x86-64 work from stacked PR #239.

Integration

main already exposes repeated squaring internally through SqrtTableHelpers::sqr_n and sqr_n_mul. Fp and Fq route these through sqr_n_runtime and sqr_n_mul_runtime; the square-root tables and pow_vartime are production callers. This PR changes only the Apple AArch64 sqr_n_runtime backend for chains longer than one. The existing fused square-and-multiply path remains instruction-for-instruction unchanged.

No downstream public API is added. The new Rust entry point is pub(super) inside the private Apple AArch64 backend, and the assembly symbol is private_extern.

Apple M4 benchmarks

Single-core, Rust/Cargo 1.88.0, aarch64-asm, 60 Criterion samples per primitive:

Fp operation	main	candidate	change
sqr_n(2)	16.757 ns	15.713 ns	-6.2%
sqr_n(8)	78.633 ns	68.743 ns	-12.6%
sqr_n(32)	325.23 ns	282.71 ns	-13.1%
sqr_n(128)	1.3120 us	1.1393 us	-13.2%
sqr_n_mul(2)	25.828 ns	25.529 ns	-1.2%
sqr_n_mul(8)	79.555 ns	79.075 ns	-0.6%
sqr_n_mul(32)	293.45 ns	292.69 ns	-0.3%
sqr_n_mul(128)	1.1490 us	1.1481 us	-0.1%

The square-and-multiply deltas converge to zero as expected because that assembly path is unchanged.

Orchard-shaped end-to-end checks used circuit,orbits, one Rayon worker, a balanced control/candidate/candidate/control bracket, and the same 64-proof fixture corpus:

workload	main mean	candidate mean	change
B1 verifier	5.7019 ms	5.7044 ms	+0.04%
B64 verifier	35.9715 ms	35.9736 ms	+0.01%

The one-Action prover settled at 285.11 ms on the adjacent control leg and 285.14 ms on the candidate leg: no measurable change, as expected.

Validation

• cargo +1.88 test --locked -p zakura-pasta-curves --features aarch64-asm
• 101 unit tests and one doctest passed on Apple M4
• cargo +1.88 check --locked -p zakura-pasta-curves --no-default-features --features aarch64-asm
• cargo +1.88 fmt --all --check
• git diff --check

[ValarDragon]

Follow-up direct sqrt benchmark on Apple M4:

operation	main	candidate	change
Fp::sqrt	2.6958 us	2.6748 us	-0.78%
Fq::sqrt	2.7045 us	2.6902 us	-0.53%

Method: balanced control/candidate/candidate/control brackets, 100 Criterion samples per leg, 10-second warmup, 10-second measurement, taskpolicy -a, Rust/Cargo 1.88.0, aarch64-asm. The reported values average the two legs for each revision, cancelling the monotonic host drift across each bracket.

Host: mac-os-2 (valars-Mini-2.localdomain), Apple M4 arm64. Load was 1.42 before and 1.67 after; there were no competing build/benchmark processes and no thermal or performance warnings.

So the faster repeated-square loop improves complete Pasta sqrt by about 0.5-0.8%. This is consistent with the B1/B64 verifier remaining unchanged because sqrt is only a small part of those workloads.