Speed up verifier identity MSMs

[ValarDragon]

Summary

• add an optional exact full-width identity-MSM hook to CurveExt;
• let the Pasta GLV backend consume reduced Montgomery residues directly for
  that identity-only operation;
• use the hook only for the final MSM checks in the built-in single and batch
  Halo2 verifiers.

Public MSM::eval, point-returning MSMs, custom verification strategies, and
the prepared fixed-base zero-check path remain canonical and unchanged.

Rationale

A Pasta scalar with value k is stored as the reduced residue R k mod q.
Interpreting those limbs directly therefore scales the complete MSM by R.
Because R is invertible modulo the prime group order, the scaled result is
the identity exactly when the canonical result is. An identity-only caller can
thus skip both scalar canonicalization and an output-point R^-1 correction.

The public hook treats full width as a performance hint only: every Some
verdict is exact for zero, sparse, small, or dense scalars, and unsupported or
unprofitable inputs return None and use best_multiexp.

Performance

These are drift-corrected interleaved control/candidate Criterion means. Each
leg used 40-50 samples, a 2 s warm-up, and a 5 s measurement period. Negative
values mean this branch was faster.

Host / backend	Single, 1 action	Single, 16 actions	Batch, 2 proofs	Batch, 8 proofs
Apple M4, 10 workers, default	-1.51%	-1.21%	-1.91%	-1.42%
AMD EPYC VM, 8 workers, default	-1.83%	-1.39%	-2.01%	-0.52%
Apple M4, 10 workers, orbits	-1.72%	-0.58%	-1.59%	-1.81%
AMD EPYC VM, 8 workers, orbits	about -2.0%	-0.68%	-1.52%	-1.67%

The orbits rows used unprepared parameters; armed prepared zero checks keep
their existing route. A point-returning version was also tested on the full
Orchard prover and was flat to 0.2-0.3% slower, so no prover or commitment path
is included here.

Release Apple-arm64 inspection confirms that the existing canonical scalar
decomposition remains instruction-for-instruction identical to main. The new
path reads Montgomery limbs without PrimeField::to_repr and performs no
output-point correction.

Testing

• Pasta full library suites, default GLV and orbits: 215 and 233 passed;
• Halo2 full library suites, default and orbits: 138 and 136 passed;
• Pallas and Vesta identity/rejection cases at 255, 256, and 257 terms;
• Halo2 specialized and below-threshold fallback cases;
• existing plonk_api valid/invalid single and batch verification, with and
  without orbits;
• stable all-feature/all-target checks and Clippy;
• Rust 1.91 MSRV checks;
• no-default-feature checks, rustdoc, rustfmt, and git diff --check.

API

This adds the defaulted public
CurveExt::try_multiexp_full_width_is_identity_vartime method. Its default
implementation returns None, preserving downstream CurveExt
implementations. The implementation also adds crate-private helpers for the
Pasta backend and Halo2's verifier-only evaluator.