Optimize variable-base multiplication witnesses

[ValarDragon]

Summary

• fuse each variable-base multiplication doubling and addition while retaining
  the accumulator in projective coordinates
• share one local batch inversion across both slope witnesses and the affine
  x-coordinate materialization
• normalize affine y only at the two boundaries where the circuit layout needs
  it
• use two independent multiplication chains in the private batch-inversion
  helper

This leaves the circuit layout and assigned advice values unchanged. It does not
depend on the prover-wide rational-advice denominator-sharing policy.

Performance

Benchmarked prepared Orchard proving with 2 actions and
RAYON_NUM_THREADS=6. The instrumented phase includes both witness synthesis
and rational-advice evaluation, so the batch-inversion accounting is included.

Each result uses alternating A/B/B/A runs with 100 measured samples per leg
(200 control and 200 candidate samples per host), after 10 warmups. Confidence
intervals use 20,000 bootstrap resamples.

Host	Combined phase mean	Combined phase p95	Full proof mean
Apple M4	-2.58%	-3.91%	-0.46%
AMD x86-64 Linux	-1.29%	-0.84%	-0.29%

The M4 combined-phase mean bootstrap 95% interval is
[-3.83%, -1.32%]. The Linux combined-phase mean interval is
[-3.19%, +0.31%]. Full-proof measurements are best characterized as flat to
slightly faster: the point estimates improve on both machines, but the effects
are small and the Linux interval crosses zero.

Safety

• differential tests compare every generated witness against group arithmetic
  and the circuit gate equations
• batch-inversion tests cover lengths 0 through 64, including empty,
  singleton, odd, and even batches
• a real two-action Orchard proof succeeds
• the complete zakura-halo2-gadgets and zakura-orchard library test suites
  pass
• --no-default-features and --all-features checks pass for
  zakura-halo2-gadgets
• formatting and git diff --check pass

There are no pub or pub(crate) API changes.

[v12-auditor]

Note

Complete: Audit complete. V12 did not find any issues that need review.

Open the full results here.

Analyzed two files, diff 50f712e...d80730a.