Retain quotient mask without domain padding

[ValarDragon]

Summary

• retain the quotient-evaluation mask as its two actual coefficients instead
  of a domain-sized zero-padded polynomial
• commit the same [a]G_0 + [b]G_1 + [blind]W value while letting multiopen
  treat the absent tail as zero
• add serial/parallel zero-padding equivalence coverage and a byte-for-byte
  multiopening proof regression

At Orchard k = 11, the retained mask allocation falls from 2,048 field
elements (64 KiB) to two field elements (64 bytes). The mask distribution and
RNG draw order were already made linear by #267; this PR only removes its
stored zero tail. Proof and verifier formats are unchanged.

Benchmark

Compared exact main 161cd1b with candidate bdcc4fd on linux-1
(val-aus-zecnode01, x86_64 AMD EPYC 9654 VM), using Rust 1.97.1. The retained
run used real one-Action Ironwood k=11 proofs, 50 flat Criterion samples per
leg, and a base/candidate/candidate/base bracket: 100 samples per variant at
each worker count. Every retained competitor log is empty; one-minute load was
0.10 before and 0.96 after the complete run.

Workers	Base	Candidate	Delta	Bootstrap 95% interval	Result
1	643.806 ms	649.974 ms	+0.958%	+0.103% to +1.536%	Invalidated by between-leg host drift
6	118.890 ms	119.103 ms	+0.179%	-0.046% to +0.484%	Neutral

The serial base medians moved from 649.935 ms in the opening leg to 637.734 ms
in the closing leg, while the two inner candidate legs were 649.993 and
649.955 ms. The bootstrap interval only captures within-leg sampling error, so
it cannot make that non-stationary bracket into evidence of a regression.

Temporary phase instrumentation also timed the two affected regions. Means
are used because the serial VM samples were bimodal.

Workers	Region	Base	Candidate	Delta	Bootstrap 95% interval
1	mask allocation and commitment	182.124 us	142.667 us	-39.457 us (-21.67%)	-33.61% to -7.76%
1	multiopen collapse	3,274.250 us	2,779.806 us	-494.444 us (-15.10%)	-27.98% to +0.55%
1	affected regions combined	3,456.374 us	2,922.473 us	-533.901 us (-15.45%)	-28.30% to +0.18%
6	mask allocation and commitment	94.042 us	85.615 us	-8.426 us (-8.96%)	-13.05% to -5.38%
6	multiopen collapse	909.604 us	906.786 us	-2.818 us (-0.31%)	-0.52% to -0.11%
6	affected regions combined	1,003.645 us	992.401 us	-11.244 us (-1.12%)	-1.61% to -0.68%

At six workers, the measured 11.24 us phase saving is about 0.009% of a whole
proof, explaining why it is invisible in E2E noise. Two Apple M4 attempts were
discarded by the guard after unrelated XProtect, launchd, and airportd activity;
no macOS result is claimed.

Validation

• cargo test -p zakura-halo2-proofs --all-features
• cargo check -p zakura-halo2-proofs --no-default-features
• cargo test -p zakura-halo2-proofs --no-default-features --lib short_trailing_polynomial
• cargo test -p zakura-orchard --all-features
• cargo fmt --all -- --check
• git diff --check
• complete GitHub CI matrix

API surface

No downstream-public API changes.

• adds pub(crate) Polynomial::<_, Coeff>::from_coefficients(Vec<_>)
• removes the unused EvaluationDomain argument from the
  pub(in crate::plonk) Argument::commit_random_polynomial method

This branch is based directly on current main and is independent of #319.

[v12-auditor]

Note

Complete: Audit complete. No review-worthy issues remain after automated review. One finding was auto-invalidated.

Open the full results here.

Analyzed five files, diff 161cd1b...bdcc4fd.

[ValarDragon]

• Orchard k=11 mask storage drops from 2,048 field elements/64 KiB to 2 elements/64 bytes. The blind is separate, so the polynomial needs two—not three—entries.
• Commitments, evaluations, and seeded multiopening proof bytes remain identical.
• Six-worker affected phases improved by 11.24 µs (−1.12%, 95% CI −1.61% to −0.68%).