Use dedicated squaring for public powers and fixed-base windows

[ValarDragon]

Summary

• compute the public-domain x^(2^k) used by Halo2 proof creation and
  verification with Pasta's dedicated repeated-squaring routines;
• generate generic fixed-base window scalars iteratively instead of repeatedly
  invoking constant-time exponentiation.

Proof bytes, transcripts, constraints, verifying keys, and generated fixed-base
tables are unchanged.

Repeated squaring

The prover and verifier need x^n, where the evaluation domain size is
n = 2^k. Calling generic constant-time exponentiation processes the complete
exponent representation. This change instead performs exactly k squarings,
using Pasta's dedicated fused repeated-squaring implementation for Fp and
Fq and a generic repeated-square fallback for other fields.

The same bridge replaces a five-exponent constant-time power used to construct
Orchard's public 2^245 circuit constant with two squarings and one
multiplication.

Fixed-base preprocessing

The generic Halo2 fixed-base table generator previously recomputed 8^w for
every window and each term of its final offset. It now advances a shared public
window scale and offset by multiplication with 8.

Orchard overrides the generic coefficient generator with checked-in precomputed
coefficient arrays. The fixed-base change therefore applies to the generic
Halo2 utility and must not be interpreted as an Orchard key-generation
speedup.

Isolated performance

Candidate is 47cf57d; values are medians from Criterion runs with 50 samples,
2 s warm-up, and 4 s measurement.

Field / host	Constant-time power	Repeated squaring	Speedup
Fp / Apple M4	7.071 us	109.88 ns	64.35x
Fq / Apple M4	7.068 us	110.25 ns	64.11x
Fp / Linux x86_64	12.008 us	184.81 ns	64.98x
Fq / Linux x86_64	11.993 us	184.72 ns	64.93x

For an 85-window full-width fixed-base table, the old implementation invoked
constant-time exponentiation 764 times: 672 times for the first 84 windows,
84 times for the final offset, and eight times for the final window. The new
implementation replaces those calls with 84 window-scale and 84 offset
multiplications. Scalar multiplication and interpolation work common to both
implementations is unchanged.

The repeated-squaring change saves about 7.0 us per call on M4 and 11.8 us per
call on Linux. It occurs once per proof and once per verification, so no
measurable complete-prover movement is claimed.

Validation

• dedicated Fp and Fq squaring bridges match repeated Field::square for
  counts 0, 1, 2, 11, and 64;
• Halo2's specialized and generic paths match repeated field squaring;
• fresh randomized full-width fixed-base coefficient reconstructions pass;
• the exact Orchard CommitIvk circuit test passes;
• all-feature checks pass for Pasta, Halo2 proofs/gadgets, and Orchard;
• the changelog and formatting checks pass.

The identical fixed-base implementation also passed the complete randomized
coefficient suite on the superseded draft before this diff was narrowed.

API

This adds two doc-hidden public cross-crate bridge functions,
pasta_curves::arithmetic::{square_fp_n, square_fq_n}. No pub(crate) surface
is added or widened, and no existing signature or visibility changes.

[ValarDragon]

Superseded benchmark: this comment originally measured candidate
c8e44b7, which included the variable-time Pasta conversion, equality, GLV,
witness-assignment, and batch-flag changes. PR #333 was narrowed at
47cf57d to repeated squaring and generic fixed-base preprocessing only.
The previous complete-prover numbers must not be attributed to the current
diff. Fresh focused results will be posted separately.

[v12-auditor]

Note

Complete: Audit complete. V12 did not find any issues that need review.

Open the full results here.

Analyzed nine files, diff 4cfcbe8...47cf57d.