Specialize x86_64 Pasta field squaring

[ValarDragon]

What changed

Replace the x86-64 ADX/BMI2 field-square wrapper with a dedicated Pasta
Montgomery square in each checked-in object format:

• ELF;
• Mach-O;
• GNU COFF; and
• MASM/Win64.

The implementation forms each off-diagonal product once, doubles the
off-diagonal half, adds the four diagonal products, and then performs four
specialized Montgomery cancellation rounds. It uses the existing Pasta
modulus identities p[2] = 0 and p[3] = 2^62.

The multiplication routine, Rust dispatch, Cargo feature, and native entry
symbol remain unchanged.

Why

The x86_64-asm square path in #53 passes the same operand twice to the
general multiplication helper. The dedicated schedule reduces the square from
28 to 18 mulx instructions while retaining the same four imul
instructions.

The current optimized one-Action Orchard profile attributes 12.39 percentage
points of samples to the square call path. This made a specialized square a
larger concrete target than the remaining evaluator and FFT cleanups, subject
to direct measurement because the new carry schedule is more serial.

Performance

The accepted incremental DigitalOcean Linux/x86_64 bracket compares
signed-Booth production control 136b5e9 with candidate 6188da5 on the same
host. Its balanced A/B/B/A mean centers were:

• control: 1,410.565382 ms;
• candidate: 1,389.756602 ms; and
• reduction: 1.475208483% (1.014972967x throughput).

The two paired reductions were 1.537903870% and 1.412473176%; the median
reduction was 1.488702281%. The clean A/A retry had 0.299914844% median drift.
All accepted legs had zero CPU steal, swap activity, and competing processes.
An earlier A/A attempt was rejected after its first leg observed one steal
jiffy, before any candidate timing, and is retained in the archive.

The comparison uses Rust 1.88, locked dependencies, a genuine valid one-Action
Orchard proof at protocol k = 11, RAYON_NUM_THREADS=1, and CPU pinning.
Keys, fixtures, and proof verification remain outside the timed region. Both
binaries are built before A/A qualification and the balanced A/B/B/A bracket.

The preserved result archive has SHA-256
d6553d54a93a3a755f90c453a09ac8d49897af8e4dd07ead6c616acfd6d3461e.
This is an incremental result, not a cumulative or root-to-tip claim; no root
benchmark or profile was run for this change.

Correctness and provenance

• The square is a direct x86-64 translation of the specialized identities in
  the existing pasta_mul-armv8.S backend.
• The four object-format implementations have byte-identical 574-byte square
  cores.
• Architectural x86-64 execution of the ELF body passed 4,101 Fp and 4,101 Fq
  cases against an independent big-integer Montgomery reference, including
  stack, nonvolatile-register, canonical-output, and memory-trace checks.
• GNU COFF unwind decoding covers the full 88-byte square frame; the MASM
  .xdata bytes match it.
• Runtime-dispatch and static-feature Rust 1.88 builds, plus focused Orchard
  proof creation and verification, pass on the available local lanes.
• Literal native ADX/BMI2 Rust differentials and the exact Orchard preflight
  run on the benchmark host before timing.

The files retain the Semolina v0.1.4 Apache-2.0 provenance headers and explain
that multiplication remains generator-derived while the square is translated
from the existing AArch64 schedule.

API and compatibility surface

No public or pub(crate) Rust item, signature, visibility, trait method, enum
variant, type alias, constant, constructor, Cargo feature, dependency,
lockfile, unsafe boundary, or serialized format changes.

The existing private square symbol keeps the same name, visibility, calling
convention, arguments, and output contract on every object format. Only its
body and the corresponding Windows unwind metadata change. Circuit
expressions, constraints, keys, transcripts, proof encoding, and proof
acceptance are unchanged.

Current final-MSM stack benchmark (2026-08-19)

The exact four-format square patch was replayed over the accepted general x86
backend and the GLV/XYZZ/multicore/c=10 stack. The incremental production
boundary was 12e8971 -> 89f60eb.

Standard balanced A/B/B/A geometric centers of means were:

Workload	General x86 ASM	Specialized square	Reduction
prover, one worker	1298.198 ms	1283.220 ms	1.153780%
verifier B1, one worker	24.237 ms	23.816 ms	1.737473%
verifier B2, one worker	26.193 ms	25.588 ms	2.310618%
verifier B16, one worker	48.121 ms	47.451 ms	1.391880%
verifier B64, one worker	124.191 ms	122.987 ms	0.969685%
verifier B64, eight workers	40.590 ms	40.140 ms	1.110165%

B2's control drift was 2.16%, so that center is diagnostic. Serial B64 paired
reductions were 0.890957% and 1.048351%; eight-worker B64 paired reductions
were 1.583354% and 0.634702%. One prover attempt was rejected after a steal
jiffy; the complete retry had zero steal in all four legs and produced the
result above.

This layer composes with #53 to give 5.956128% lower proving latency,
2.239169% lower serial B64 latency, and 4.165871% lower eight-worker B64
latency over PR #93. Those are composed from the two direct incremental
brackets, not a separate endpoint run.

Current-stack archive SHA-256:
f35c6c98d9e1aa88f2280c4310ebef573b79ae6f621f59be0f47bd306013521f.

[ValarDragon]

We'll likely go about this via inline ASM

[ValarDragon]

Closed because its base PR #53 was closed unmerged and this approach has been superseded by #222, which provides the current inline x86-64 backend and dedicated squaring implementation.