Cache Groth16 public-input bases for single-proof verification

[ValarDragon]

Summary

Cache width-five window tables for the fixed public-input G1 bases when a
Groth16 verifying key is prepared. Single-proof verification uses those tables
with variable-time recoding of public inputs. The pairing equation and proof
acceptance rules are unchanged. This adds roughly 2.25 KiB of prepared-key
storage per public-input base and moves table construction to key preparation.

Measurement

Local Criterion, eight proof checks per iteration:

Public inputs	main	This branch	Time reduction
1 (existing valid MiMC benchmark)	8.64 ms	8.08 ms	about 6%
7 (diagnostic matching Sapling Spend's input count)	18.40 ms	12.59 ms	about 32%

For the seven-input diagnostic, width five measured 12.45 and 12.59 ms in
two runs; width four measured 13.09 and 12.88 ms. The one-input comparison
was 8.08 ms at width five versus 8.00 ms at width four, so the larger table
is a small regression for that case.

The seven-input diagnostic uses a MiMC proof and an expanded verifying key,
so the proof is invalid, but verify_proof executes the complete input MSM,
Miller loop, and final exponentiation before returning the result. The
diagnostic benchmark code was not included in this PR.

Checks

• cargo test -p zakura-bellman --lib --locked (58 tests)
• cargo test -p zakura-bellman --lib verify_seven_public_inputs --locked
• cargo test -p zakura-bellman --test mimc --locked
• cargo test -p zakura-sapling-crypto --lib --locked (69 tests)
• cargo check -p zakura-bellman --no-default-features --features groth16 --locked
• cargo fmt --all -- --check
• git diff --check

The new test verifies a valid proof with seven public inputs and rejects a
change at each position. No public or crate-visible Rust API changes; the
public PreparedVerifyingKey type gains one private cached field.

[v12-auditor]

Note

Complete: Audit complete. No review-worthy issues remain after automated review. One finding was auto-invalidated.

Open the full results here.

Analyzed two files, diff 22f98f8...d49c155.