logUp grouping

[gabriel-barrett]

logUp: circuit-local message grouping

Adds CircuitInputs::lookup_group_size (default 1): one chained
accumulator step may consume k consecutive messages instead of one,
committing ⌈L/k⌉ stage-2 accumulator slots instead of L — at the
cost of a higher logUp constraint degree. The option is per circuit,
not global: whether grouping fits depends on each circuit's message
degrees and its remaining degree budget.

How it works

The ungrouped chained step forces acc' = acc + mult/m via
m·(acc' − acc) − mult = 0. For a group m_0, …, m_{s−1} the
sum-of-fractions identity is multiplied through by the group's message
product:

(Π_j m_j) · (acc' − acc)  −  Σ_j mult_j · Π_{j'≠j} m_{j'}  =  0

which forces acc' = acc + Σ_j mult_j/m_j exactly as s ungrouped
steps would, but with one committed accumulator slot instead of
s. Lookups are chunked in order; the last group may be smaller. The
final group's step targets the next row's slot 0 plus the boundary
injection is_last_row·Δ, so the cyclic-telescoping argument is
unchanged from the chained scheme.

The degree per group is roughly Σ_j deg(m_j) + 1 (precisely
max(Σ deg(m_j) + 1, max_j [deg(mult_j) + Σ_{j'≠j} deg(m_{j'})]),
computed analytically by logup_max_degree). E.g. two degree-1
messages group at degree 3; degree-2 messages usually can't afford
grouping — hence the circuit-local dial.

Implementation

• synthesize_lookups (the pinned executable spec) and
  logup_constraint_values (the direct evaluator used by prover and
  verifier) chunk lookups by the group size. Group products use
  prefix/suffix arrays so each Π_{j'≠j} costs one multiplication;
  scratch stays on the stack, bounded by MAX_LOOKUP_GROUP = 8.
• The singleton-group path is special-cased to the exact
  pre-grouping arithmetic — the default k = 1 pays nothing for the
  feature.
• stage_2_traces pushes one accumulator per group per row; still a
  single batch inversion plus one linear pass, one multiply-add per
  (row, lookup).
• The group size is observed into the transcript shape
  (observe_shape): it changes the constraint structure, which
  counts and degrees alone don't pin down.
• Setup asserts lookup_group_size ≤ MAX_LOOKUP_GROUP and the usual
  quotient-degree bound fails loudly for a too-aggressive grouping.