Use alpha-eight tables for private prepared MSMs

[ValarDragon]

Summary

• Use alpha-eight prepared tables for the measured 2,048-term SRS tier in the
  private AArch64 macOS multicore/no-orbits evaluator.
• Raise only that private route's per-table budget from 13 MiB to 25 MiB.
• Preserve the existing alpha-seven choice for other targets, non-power-of-two
  sizes, budget failures, and the public orbits planner.
• Exercise the private evaluator in AArch64 macOS assembly CI.

The route is intentionally narrow. It first runs the existing planner and
substitutes alpha-eight only when that planner selected alpha-seven, the input
is a power of two, the target is AArch64 macOS, and the wider table still fits
the private 25 MiB budget. At Orchard's k = 11, this selects the 2,048-term
coefficient and Lagrange tables.

Performance

One hundred accepted balanced, interleaved pairs on a 10-core Apple M4
measured the clean current-main control (e1cbe51) against this one-commit
candidate (e38e822). The binaries used Rust 1.97.1, ThinLTO,
aarch64-asm, multicore, and no orbits; explicit preparation was outside
the timed proof.

Proof shape	Paired change	95% CI
1 Action	-0.472 ms	[-0.646, -0.299] ms
4 Actions	-0.987 ms	[-1.290, -0.678] ms

Explicit preparation increased by about 30.0 ms (approximately 32.3 ms to
62.3 ms). On this host, that setup cost amortizes after roughly 64 one-Action
proofs or 31 four-Action proofs. The host recorded no thermal or performance
warnings and no swap activity. Deterministic 1-Action and 4-Action proof bytes
were identical between the two arms.

Memory and setup tradeoff

Each Orchard-sized prepared table grows by about 12.4 MiB. The coefficient and
Lagrange tables therefore grow from about 24.8 MiB to 49.6 MiB in total;
including the existing blind table, retained commitment preparation grows from
about 25.3 MiB to 50.1 MiB.

Preparation remains explicit, cached, shared across proving-key clones, and
outside proof timing. One-shot or cold provers need not opt into it.

Correctness and scope

• The codebook arithmetic and proof protocol are unchanged; this changes only
  the private prepared-table mode selected for the scoped target and size.
• The public orbits planner, its 13 MiB per-table budget, and its downstream
  behavior are unchanged.
• Deterministic proof hashes matched for both measured shapes:
  77ceabe276a5ec1321dac293cb7c1b99303aaf437e91baca8319d4f70c46fc75
  (1 Action) and
  629d5bb4ea86cd0cdf630e6b9949fdf04c7089b5e3f51bed75ba3a0441453afe
  (4 Actions).

API changes

There are no downstream public item or signature changes.

• Adds the feature-gated pub(super)
PreparedZeroMsm::prepare_no_orbits helper under
  cfg(all(feature = "multicore", not(feature = "orbits"))).
• Compiles the existing public PreparedZeroMsm::prepare method under
  cfg(any(test, feature = "orbits")); it remains available everywhere the
  public glv::zero module is available.

[ValarDragon]

Exact current-main target confirmation

After #249 merged, I rebuilt and benchmarked the exact merge of:

• main@612b0b87709210d15c68d0ee5e1d51313443d8d0;
• this PR's live head, 4c11963279cb63906d9424bf1eb2745a4331a866.

The conflict-free synthetic merge is d001e5f8891ff11e61b498040231a5dc4ab958a5
with tree 0971254b0f359ae0dcac12fe6e83699a1e5967e4. Relative to the previous
accepted main@27f8de2 tree, it differs only by #249's private in-place
multi-opening division helper and changelog.

The four-Action Orchard prover ran on mac-os-2 (Apple M4, arm64), Rust/Cargo
1.98, with RAYON_NUM_THREADS=10 and
ORCHARD_K11_PROVER_THREADS=10. The build fingerprint records
aarch64-asm and multicore, with no orbits; proving-key and prepared-table
construction remain outside the timed proof.

Run	95% confidence interval	Point estimate
1	145.77-147.23 ms	146.40 ms
2	145.83-146.21 ms	146.02 ms
3	145.69-146.07 ms	145.87 ms

The median point estimate is 146.02 ms. All three runs are below the
150 ms target, including every confidence-interval upper bound; the highest
upper bound is 147.23 ms. Median maximum RSS was 219.14 MiB. The host reported
no thermal or performance warnings and zero configured or used swap.

Provenance hashes:

• source archive: 95894788edf05b5982b21925f1b64675c8053c48eab5afbad3134e1b69096ff9;
• benchmark binary: 5e1d250dc8f08a89681e9b3c3aa3308d5503e27d72f43c024a12409345fdd366;
• retained log: 8657c82408051b26cdbc83524b4be1758fe751a200bfa0c5b63004436f0de469.

Focused validation on this exact merge also passed the default and strict
no-default Pasta zero suites, Halo prepared/unprepared differentials,
multi-opening tests, proof creation, and a real ten-worker Orchard
prepare/prove/verify smoke test for one, two, and four Actions.