Use a linear quotient-evaluation mask

[ValarDragon]

Summary

• replace the dense random polynomial used to mask the quotient evaluation
  with a random linear polynomial
• commit to its two coefficients and independent Pedersen blind with a
  three-base MSM instead of a domain-sized MSM
• evaluate the linear mask directly instead of using a domain-sized inner
  product
• document and test the transcript-order invariant that makes two
  coefficients sufficient

At Orchard's k = 11, this replaces one 2,049-term commitment with a
three-term commitment and one 2,048-term evaluation with a multiply-add. The
polynomial remains in the existing dense storage form, so the multi-opening
representation is unchanged.

This is not the sparse IPA masking polynomial introduced by #224. That mask
is sampled after x_3 and retains its power-of-two support for the IPA
folding functional. This change targets the separate PLONK
quotient-evaluation mask committed before y, which is exposed through
exactly two evaluation functionals.

Security argument

Write the mask as r(X) = a + bX. The prover commits to R with an
independent Pedersen blind before sampling y, later reveals r(x), commits
to q_prime with a fresh blind, and only then samples x_3.

The point-set group at x ends with h followed by r. Horner folding
therefore gives r unit coefficient, so the later quotient value contains
one affine contribution r(x_3). The map

(a, b) -> (r(x), r(x_3))

has determinant x_3 - x. The multi-opening verifier rejects x_3 equal to
any queried point, so the two revealed functionals are full-rank except for
the scheme's existing negligible challenge-collision event. Independently
blinded commitments hide the coefficients before their challenges, and the
IPA applies its separate sparse mask before revealing its final scalar.

Tests now pin direct evaluation, the two-evaluation rank fact, the global
h-then-r query order, and the Horner direction: collapsing marker
polynomials [h, r] at x_1 = 0 yields r.

Compatibility and API

• proof encoding, proof length, verifier behavior, and downstream APIs are
  unchanged
• fixed-seed proof bytes intentionally change because the prover consumes two
  mask coefficients instead of a full domain of random coefficients
• no public or pub(crate) item or signature changes
• the module-restricted ConstructedQuotient::evaluation_query helper is
  removed
• module-restricted ConstructedQuotient::evaluate now accepts x directly
  instead of a precomputed random-mask evaluation

Cold-proof benchmark

Rust 1.97.1, ThinLTO, circuit,multicore,orbits, Apple M4, ten workers. Each
sample starts a fresh process, explicitly prepares the proving key outside
the timed region, and times the first real Orchard proof. Control was #313
head 0328221; candidate was the same tree plus this patch at 177a4f2.
The #267 patch is byte-for-byte identical on the submitted current-main
rebase, and #313 changes only the later IPA phase. Order alternated
transactionally; intervals are paired 95% bootstrap intervals. Every proof
verified, with zero swap and no thermal or competitor violations.

Actions	Pairs	Control	Candidate	Delta	95% CI	Wins
1	60	56.409 ms	55.370 ms	-1.038 ms (-1.84%)	[-1.309, -0.761] ms	55/60
4	60	141.135 ms	140.079 ms	-1.056 ms (-0.75%)	[-1.396, -0.717] ms	49/60

The fixed dense-mask commitment measured 1.041 ms for one Action and
1.049 ms for four Actions in the accompanying current-stack phase census,
which agrees with the end-to-end saving.

Validation

• Rust 1.97.1 release/Orbits full Halo2 unit, integration, and doc tests
• Rust 1.91 MSRV release/Orbits full Halo2 test suite
• Rust 1.97.1 no-default-feature library check
• verified Orchard k = 11 proofs and unchanged canonical proof lengths
• direct sparse-evaluation and commitment equality tests for both Pasta curves
• transcript-order, Horner-direction, and exceptional-point regressions
• formatting, diff, terminology, repeated-literal, and visibility checks

Submitted head is rebased on current main 98846ee, including #315.

[ValarDragon]

Re-benchmarked the PR 267 changes against main on the six-worker macOS configuration.

Comparison revisions:

• main at benchmark time: 07c011b
• candidate: 92fda8255f3f93ac50e33155a1d6e8879c62d483, a local-only rebase of the six PR commits onto that main
• main-to-candidate diff SHA-256: b501f970b4c04a0c461551464c35cfc37bc382338eb03bbb7ad27a87f03e52ab

The synthetic candidate was used so missing main commits could not confound the comparison; it has not been pushed to the PR.

Orchard proof	main mean	PR 267 mean	reduction	speedup
1 action	68.914 ms	67.914 ms	1.000 ms / 1.451%	1.0147x
4 actions	180.141 ms	179.101 ms	1.040 ms / 0.577%	1.0058x

Per-pair time reductions were consistent:

Pair	1 action	4 actions
1	1.429%	0.501%
2	1.399%	0.762%
3	1.526%	0.469%

A simple paired t interval over the three pair deltas is 1.286–1.616% for one action and 0.178–0.977% for four actions. All six individual Criterion mean confidence intervals also separated in the faster direction. The four-action effect is small, but these repetitions support it being real rather than benchmark noise.

Configuration and controls:

• mac-os-1, Apple M4, 10 physical/logical cores, running exactly 6 Rayon workers
• macOS 26.6.2; rustc/cargo 1.97.1
• release build with ThinLTO and default Cargo codegen units
• --no-default-features --features circuit,multicore; Orbits disabled
• real Orchard k=11 one- and four-action proofs; proofs verified outside the timed region
• Criterion flat 10 samples, 2 s warm-up, 15 s measurement per benchmark
• three alternating pairs in main/PR, PR/main, main/PR order
• 12 clean admission samples before the first leg and at least 6 before every later leg; load1 <= 2.0, zero swap, and no thermal or performance warnings

The original final PR leg was rejected because launchd reached 26.8% CPU during it. No estimate from that leg was used. Its replacement used the same binary and settings after a fresh 12-sample quiet admission and passed all guards.

[ValarDragon]

We update this to three coefficients (degree at most 2) in the follow-on PR #294.