Gate q-prime remainder evaluation by work

[ValarDragon]

Summary

• gate the q-prime remainder-derived evaluation added in Derive q-prime evaluation from division remainders #373 by an
  overflow-safe estimate of its field work
• keep the optimized path for Orchard's k=11 shape, while retaining direct
  evaluation for smaller domains or unusually large point-set shapes
• avoid allocating or retaining division-remainder buffers when the direct
  path is selected
• strengthen the regression coverage for the challenge-collision fallback and
  independently reconstruct the former masked-polynomial evaluation before
  checking proof-byte equality

Cost model

For S point sets and M queried points, the derived path charges exactly
2M + 4S - 1 field multiplications plus a conservative 1,024-multiplication
allowance for its one inversion. It is selected only when that total is
strictly below the n - 1 multiplications of direct evaluation.

Orchard has S=5 and M=11, so the non-inversion work is 41 multiplications:
k=11 keeps the derived path, while k=10 conservatively uses direct evaluation.

Validation

Rust 1.97.1:

• default/multicore focused q-prime tests: 3 passed
• default/multicore former-path and proof-byte test: 1 passed
• no-default focused q-prime tests: 3 passed
• no-default former-path and proof-byte test: 1 passed
• the equivalent pre-rebase commit also passed the complete multicore,
  no-default, and orbits halo2-proofs library suites
• cargo fmt --check and git diff --check

API and protocol behavior

No public or crate-visible API is added or widened. The Orchard transcript,
RNG consumption, proof bytes, verifier behavior, and k=11 optimized path are
unchanged.

[v12-auditor]

Note

Complete: Audit complete. V12 did not find any issues that need review.

Open the full results here.

Analyzed two files, diff 9e57b44...f23db3e.