Reuse sparse opening work in the IPA

[ValarDragon]

Rebased onto latest main; #267 and #298 are now merged.

Summary

• Reuse the prepared W blinding table in the sparse quotient and IPA mask
  commitments. The quotient mask now has three random coefficients (degree at
  most two), so its three-term body is large enough to overlap with the
  prepared blind multiplication when multiple workers are active. The 12-term
  IPA body uses the same path.
• Evaluate q-prime alongside the independent Q polynomials, then fold those
  evaluations with x_4. This avoids a later serial domain-sized evaluation
  of the already-folded IPA polynomial while retaining Track IPA power-vector folds symbolically #298's symbolic IPA
  power-vector folds.
• Preserve the existing combined-MSM fallback when preparation is unavailable,
  including with Orbits, and keep the public IPA API unchanged.

The transcript and proof format are unchanged. If
P = (((q_prime * x_4 + Q_0) * x_4 + Q_1) ...), then evaluation is a ring
homomorphism, so the same Horner fold over q_prime(x_3), Q_i(x_3) is exactly
P(x_3). The sparse IPA mask has a root at x_3, so masking does not change
that value.

For the quotient mask r(X) = a + bX + cX^2, the exposure map is

(a, b, c) -> (r(x), r(x_3)).

Its first two columns have determinant x_3 - x. The verifier rejects the
exceptional collision, so this map has rank two and a one-dimensional kernel.
Consequently the two evaluations are jointly uniform, and fixing both still
leaves one uniformly random coefficient of excess entropy. The independent
Pedersen blind hides the coefficient commitment before the challenges.

Benchmarks

The following full-proof measurements predate the rebase. Parent: 63929d0
(#267). Candidate: d87544a. Rust 1.97.1, GLV enabled, Orbits disabled, real
Orchard k = 11 proofs. Each cell is the aggregate of three alternating
parent/candidate Criterion runs (10 flat samples, 2 s warm-up, 15 s
measurement) admitted only after host-idle, swap, competitor, and thermal
checks.

Host	Workers	Actions	Parent	Candidate	Delta
Apple M4	1	1	249.843 ms	248.804 ms	-0.42%
Apple M4	1	4	725.404 ms	725.365 ms	-0.01%
Apple M4	6	1	68.206 ms	68.081 ms	-0.18%
Apple M4	6	4	180.251 ms	180.037 ms	-0.12%
AMD EPYC VM	1	1	666.726 ms	665.445 ms	-0.19%
AMD EPYC VM	1	4	1924.415 ms	1941.722 ms	+0.90%
AMD EPYC VM	6	1	126.961 ms	126.485 ms	-0.37%
AMD EPYC VM	6	4	352.483 ms	354.489 ms	+0.57%

All three Apple M4 six-worker mean pairs improved: 0.14-0.22% for one action
and 0.04-0.22% for four actions. The Apple M4 one-worker pairs and every Linux
configuration changed sign. I therefore treat the one-worker and Linux
whole-proof results as inconclusive; only the small Apple M4 six-worker change
repeated across all three pairs.

The isolated sparse-commitment harness alternates the old combined MSM and
the new path five times. The table reports the median paired change:

Host	Commitment	1 worker	6 workers
Apple M4	quotient mask	-8.1%	-23.9%
Apple M4	IPA mask	-2.9%	-9.7%
AMD EPYC VM	quotient mask	-8.9%	-30.1%
AMD EPYC VM	IPA mask	-3.4%	-15.7%

Moving the quotient mask from two to three terms crosses the threshold for the
parallel prepared-blind path, which explains its new six-worker improvement.
The changed commitments save only microseconds, which is consistent with the
effect being difficult to resolve inside a 68-1942 ms complete proof.

After rebasing, a release-mode smoke run of the internal paired harness on an
Apple M4 Max reconfirmed the isolated effect over five alternating repetitions:

Commitment	1 worker	6 workers
quotient mask	-9.3%	-25.9%
IPA mask	-3.3%	-15.1%

Validation

• cargo +1.97.1 test -p zakura-halo2-proofs --features multicore
• cargo +1.97.1 test -p zakura-halo2-proofs --features orbits
• proof-byte equality between direct and precomputed IPA evaluations
• exact group equality between combined and prepared sparse commitments
• quadratic quotient-mask rank/kernel checks over both Pasta fields
• proof equality across one- and multi-worker pools
• Orbits IPA proof-byte and multiopen round-trip tests
• cargo +1.97.1 check -p zakura-halo2-proofs --no-default-features
• formatting, diff, terminology/literal, and changelog checks

API surface

No downstream-public API changes. This adds the internal pub(crate) method
Params::try_commit_sparse_with_prepared_blind. It also adds an evaluation
argument to the existing pub(in crate::poly)
commitment::create_proof_with_powers helper; that helper remains confined to
the poly module.

[ValarDragon]

Updated the quotient mask to three random coefficients (degree at most two) in
d87544a; d04d072 updates the changelog with the new measurements. This
supersedes the earlier two-coefficient benchmark report.

For r(X) = a + bX + cX^2, the map
(a, b, c) -> (r(x), r(x_3)) has a nonzero 2 x 2 minor x_3 - x whenever
the verifier accepts the challenge points. It therefore has rank two and a
one-dimensional kernel: the two exposed evaluations are jointly uniform, and
one random coefficient remains after both are fixed.

Complete real Orchard k = 11 proofs, three alternating pairs per cell:

Host	Workers	Actions	#267 parent	Three-term candidate	Delta
Apple M4	1	1	249.843 ms	248.804 ms	-0.42%
Apple M4	1	4	725.404 ms	725.365 ms	-0.01%
Apple M4	6	1	68.206 ms	68.081 ms	-0.18%
Apple M4	6	4	180.251 ms	180.037 ms	-0.12%
AMD EPYC VM	1	1	666.726 ms	665.445 ms	-0.19%
AMD EPYC VM	1	4	1924.415 ms	1941.722 ms	+0.90%
AMD EPYC VM	6	1	126.961 ms	126.485 ms	-0.37%
AMD EPYC VM	6	4	352.483 ms	354.489 ms	+0.57%

All three Apple M4 six-worker mean pairs improved (0.14-0.22% for one action,
0.04-0.22% for four); the one-worker Mac and all Linux configurations changed
sign between pairs, so I treat those whole-proof aggregates as noise.

Median paired isolated sparse-commitment changes:

Host	Commitment	1 worker	6 workers
Apple M4	quotient mask	-8.1%	-23.9%
Apple M4	IPA mask	-2.9%	-9.7%
AMD EPYC VM	quotient mask	-8.9%	-30.1%
AMD EPYC VM	IPA mask	-3.4%	-15.7%

The third quotient term crosses the multicore threshold for splitting the
three-term MSM body from the prepared blind multiplication, which is why the
quotient path now improves at six workers instead of taking the fallback.

Protocol: Rust 1.97.1, ThinLTO, GLV enabled, Orbits disabled, Criterion 10 flat
samples with 2 s warm-up and 15 s measurement, and load/swap/competitor/thermal
admission gates. Rejected attempts remain in the archives.

Artifact SHA-256:

• macOS: 6347f3ae193a4cb3054830cae3ac9756f4537563371de2af6bf0ba05c36defee
• Linux: a510653026c105ca93d79f3e2cd84d4393434d8a1277a7b2d4bee47655091b7b