Prepare prover commitments without orbit MSMs

[ValarDragon]

Summary

This enables the prepared Pasta commitment evaluator in the default
multicore configuration, without enabling the orbit MSM planner.

• Compile the fixed-base prepared evaluator privately when multicore is
  enabled and orbits is disabled.
• Build the coefficient- and Lagrange-basis tables atomically, so neither is
  exposed unless both preparations succeed.
• Reuse the preparations for exact-size prover commitments while retaining the
  existing planned MSM fallback outside the measured worker-width gate.
• Prepare Orchard proving keys under the default feature set.

The public glv::zero module remains gated on orbits; the default build
only exposes the existing trait-based interface.

Performance

On an Apple M4 (mac-os-2, arm64), with
RAYON_NUM_THREADS=10 ORCHARD_K11_PROVER_THREADS=10, the matching no-orbits
prototype improved the four-action Orchard prover from 174.42 ms to 158.46 ms
on the isolated #245+#246 ABBA gate: -15.96 ms (-9.15%). On the wider
#245-#253 stack, it improved 172.44 ms to 155.96 ms (-9.55%).

Preparation is outside the timed proof. The two k = 11 alpha-seven tables
took 33.27-34.13 ms to build, repeat preparation took 0.042-0.209 microseconds,
and peak RSS increased by 26.19 MiB. Exact one-, two-, and four-action proof
bytes and hashes matched and every proof verified with orbits disabled.

On current main@27f8de2, the exact final composition through #275 measured
146.08 ms over three clean four-action runs. Every confidence-interval upper
bound was at most 146.64 ms. That is a combined integration gate, not an
isolated #270 delta.

API and behavior changes

• The existing public PreparedZeroCheck trait and
  CurveExt::try_prepare_zero_check method are now available with either
  multicore or orbits, rather than only orbits. Their signatures are
  unchanged. Plain single-core glv builds do not gain this API. Halo2's
  public arithmetic re-export gains the same feature-gated availability.
• Existing public Params::prepare_commitments and Orchard
  ProvingKey::prepare_proving calls now build and use preparations in the
  default multicore/no-orbits configuration instead of returning
  false/acting as a no-op.
• The crate-private Params::lagrange_table availability is broadened to
  multicore || orbits.
• A new pub(super) glv::prepare_zero_check helper keeps the no-orbits
  implementation module private.
• Private AssertUnwindSafe wrappers around stored prepared handles preserve
  the historical Params UnwindSafe and RefUnwindSafe auto traits without
  adding bounds to the public PreparedZeroCheck trait.

Preparation uses OnceLock. Callers should prepare once before entering
concurrent Rayon proving work. Concurrent external callers are safe and share
or wait for the same initialization, but cold preparation from every worker
could park workers behind the initializer.

The returned evaluator is variable-time. Inputs to zero-check methods must be
public; the point-returning prover MSM may use secret scalars only when its
caller explicitly accepts the existing variable-time MSM side channel.

Validation

• zakura-halo2-proofs default and all-feature library suites.
• zakura-orchard library suite.
• No-default and multicore-only feature checks.
• Rust 1.91 default and all-feature checks.
• Prepared/unprepared differential tests, including cache sharing, atomic
  decline, panic retry, serialization, thread routing, and verified Orchard
  proofs.
• Default and orbits-only cargo-semver-checks (223/223 checks), plus the
  transitive Orchard default-feature semver check.
• cargo +1.91.0 fmt --all --check.

Stack

This draft is rebased directly onto main@9e415b9 after #272 merged. The
private paired_windows_sum helper is compiled for all multicore builds so
the new no-orbits caller uses the same measured scheduler; this cfg integration
change adds no API or signature.

[ValarDragon]

Current-main integration update:

• Compact prepared affine bucket reductions in place #272 merged and advanced main to 9e415b9; this PR is now rebased
  directly onto that commit at head 2b389c0.
• The rebase exposed the cfg interaction with Fold parallel Signed-Booth windows once #245: the private
  paired_windows_sum helper was compiled only with multicore + orbits,
  while this PR introduces its first multicore + !orbits prepared caller.
  The commit therefore restores that private helper for all multicore
  builds. It preserves the measured scheduler and changes no public,
  pub(crate), or pub(super) API or signature.
• The executable diff against the previous reviewed Prepare prover commitments without orbit MSMs #270 head is unchanged;
  the final revision also clarifies security rustdoc and the Halo2 re-export
  changelog. Focused no-orbits tests pass with both multicore and
  multicore,aarch64-asm; the strict no-default multicore configuration was
  also checked.

The exact merge of the live stack with current main@27f8de2 has tree
e3f1ebfa. It measured a 146.08 ms median on Apple M4 with ten threads and no
orbits; all three confidence-interval upper bounds were at most 146.64 ms.
That is a combined integration gate, not an isolated performance claim for
this PR.

[ValarDragon]

Benchmarking on mobile

[ValarDragon]

[ValarDragon]

Ok Ai got a bit a carried away on this one, I'd rather have just A/B tested Orbits to being default on and delete this. But its fine