Bind useful_bits + const_pin into statement digest; pin hash walkers

[aryaethn]

Summary

Addresses two items from the security audit (#1), both under "bind useful_bits, const_pin, circuit ID":

1. Statement digest completeness. BlockR1cs::statement_digest() absorbed m, k_log, k_skip, and the three matrices, but omitted useful_bits and const_pin — both of which change protocol semantics:

• useful_bits is the padding boundary (which rows carry witness vs. zero padding), so it changes the lincheck equation.
• const_pin drives the lincheck β-pin term.

Two instances differing only in those fields produced the same digest, so the Fiat-Shamir binding in bind_statement didn't separate them. This PR absorbs both (with a length-unambiguous Option encoding for const_pin) and bumps the domain tag flock-r1cs-stmt-v0 → v1, so a v0 transcript can never collide with a v1.

2. Hash walkers advertise the constant pin. Blake3LincheckCircuit and Sha2LincheckCircuit didn't override const_pin_col(), so they inherited the trait default None — silently dropping the lincheck β-pin term if used directly. (The live matrix path already carries the pin via BlockR1cs::{sparse,csc}_lincheck_circuit.) Both now return Some(Z_CONST_POS), matching the setup, closing the all-zero-witness gap if these public circuits are used directly.

Tests

• New statement_digest_binds_useful_bits_and_const_pin: determinism, plus distinct digests when useful_bits, const_pin presence, or the pin column index changes.
• Extended lincheck_circuit_matches_sparse (blake3 + sha2) to assert the walker's const_pin_col() matches the pinned sparse circuit.
• Full suite green (337 tests, 0 failures) on x86-64 Linux via the scalar fallbacks.

Notes

• The v0 → v1 tag bump changes the digest value, but the prover and verifier compute it identically, so honest proofs still verify (the end-to-end roundtrip test passes). It does invalidate proofs serialized against the old transcript — assumed fine pre-release; happy to handle compatibility differently if not.
• Can split into two PRs (digest vs. walker pin) if you'd prefer to review them separately.