Reuse prepared IPA work and share orbit MSM window shifts

[ValarDragon]

Reuse the prepared coefficient table for the first IPA round when orbits
is enabled, share positional doublings through a balanced orbit-MSM window
tree, and omit the final generator fold whose result the prover never uses.
The ordinary Signed-Booth and prepared point-returning Horner routes remain
in place.

This ports the remaining optimization work onto current main; scratch
reuse and first-round preparation for the default backend are already
present in the base. No public or pub(crate) API changes, new persistent
tables, circuit changes, or proof-format changes.

Validation: 444 library tests passed with orbits, including comparison of
prepared/unprepared IPA commitments and identical seeded proof bytes. The
window-tree tests cover both Pasta curves, empty and odd window counts,
identity and inverse points, and failure propagation from every leaf.

Benchmark-server measurements are in progress against base
46d9ed695208d848490637adef0e3b3818665263 and implementation
82980942ea570f16229a850e8d602bfbe86defee, using Rust 1.97.1, the real
Ironwood two-spend fixture, default and orbits features, and 1/4/8 workers.
Four-worker measurements use control/candidate/candidate/control ordering.
The results will be added before this PR leaves draft.