Speed up prepared commitment blinding and evaluation

[ValarDragon]

Summary

This reduces the remaining per-commitment overhead after the default
no-orbits prepared tables are armed.

The first commit adds a private byte-window fixed-base table for the blinding
generator. Prepared coefficient and Lagrange commitments keep the polynomial
borrowed, evaluate the prepared polynomial MSM with no extra term, and add the
blind from this table.

The second commit overlaps the prepared polynomial evaluation with blind
evaluation through the existing multicore join. The two changes remain
separate commits for review, but are proposed together because the overlap
delta is too small for an independent PR. Each commit carries its matching
changelog state.

Correctness and side channels

PrimeField::Repr is treated as opaque. A probe chooses a candidate byte
order, and every multiplication decodes the actual representation and requires
it to equal the input scalar. Unsupported byte order or representation-length
mismatch falls back to native multiplication.

The multiplication is variable-time in the blind scalar: it skips zero digits
and uses digit-indexed lookups. Halo2's prover MSM paths already accept
variable-time evaluation of secret inputs.

Tests cover Pallas and Vesta; random scalars; zero, one, minus one, and the
probe; radix/window boundaries through the top partial window; unsupported byte
order; representation-length mismatch; cache sharing; serialization; atomic
decline; and panic retry.

Performance

Benchmarked production revisions (the final PR differs only by restacking and
the numbered changelog fragment):

• Control A: 5a7b2492382385dd0683535aef376ca64bafcc58
• Fixed blind B: ca26c90615c34d075c76a3b74c71fa28ca4faecf
• Fixed blind + overlap C: 6cc4ce30c613b0bbd7699c8dd58f6d9246e1d64a

The live current-main commits are b0a780f for the fixed table and b5549b6
for the PR head.

The four-action Orchard prover ran on mac-os-1 (Apple M4, arm64), Rust
1.97.1, with ten Rayon/Orchard threads. Each comparison used drift-bracketed
control/candidate rounds:

Comparison	Block 1	Block 2	Aggregate
Fixed blind B vs A	-0.261%	-0.430%	-0.346%
Overlap C vs B	-0.171%	-0.232%	-0.202%
Combined C vs A	-0.831%	-0.559%	about -0.70%

The isolated sub-deltas are within Criterion's noise threshold; the direct
combined comparison is directionally stable and matches the earlier combined
stack result (-0.844%). This is why the two commits are one PR.

For a 32-byte Pasta scalar representation, the table retains exactly 8,160
affine points, or 522,240 bytes (0.498 MiB). On the benchmarked M4 the full
default no-orbits preparation moves from about 34 ms and 24.8 MiB to about
36 ms and 25.3 MiB. The overlap commit adds no persistent allocation.

API changes

None. All new types, constants, cache fields, and helpers are private.

Validation

• zakura-halo2-proofs default and all-feature library suites.
• zakura-orchard library suite.
• No-default and multicore-only feature checks.
• Rust 1.91 default and all-feature checks.
• Focused fixed-table/fallback test on Rust 1.91.
• cargo +1.91.0 fmt --all --check.

Stack

This draft is stacked on #270, which is rebased directly onto
main@9e415b9 after #272 merged.