perf(ecsm): 7.7x faster witness generation

[diegokingston]

Summary

compute_witness (one ECSM ecall's witness): 20.8ms → 2.7ms measured (high-popcount scalar, ~380 steps). At 4 ecalls per ecrecover that's ~83ms → ~11ms host per recovery; ~8.3s → ~1.1s for a 100-signature block.

Three changes:

1. Hand-rolled Jacobian replay (dbl-2009-l / madd-2007-bl) over k256's public field arithmetic, using the crate's own Montgomery batch-inversion for z-normalization and slope denominators. Replaces k256's ProjectivePoint::batch_normalize, which measured ~5-6ms for the ~760 points of one witness — no better than 760 individual to_affine() calls (its inner BatchInvert is fine at ~60µs; the total never gets the batching benefit).
2. shifted_quotient: one div_rem instead of separate % (divisibility assert) and / — halves the 512/256-bit BigInt divisions (6 → 3 per step).
3. build_step loop on rayon — steps are independent witnesses.

The subtle part (caught by the parity tests)

The first Jacobian version produced wrong points: k256's lazy-magnitude negate(1) is only correct below ~2p, so subtraction chains over unnormalized intermediates miscompute (this is why k256's own formulas call normalize_weak after every add-chain). Fixed with strategic normalize() on intermediates feeding subtractions, documented in the code. Parity with the BigUint reference replay is covered by tests::curve_tests.

Verification

• 15/15 ecsm crate tests (parity vs the reference replay).
• 8/8 prover ECSM tests: full prove+verify of the ecsm guests + the forged-witness rejection tests.
• Timing harness included: cargo run --release --example bench_witness -p ecsm.

[diegokingston]

/bench

[github-actions]

Benchmark — ethrex 20 transfers (median of 3)

_{Table parallelism: auto (cores / 3)}

Metric	main	PR	Δ
Peak heap	57086 MB	57319 MB	+233 MB (+0.4%) ⚪
Prove time	30.840s	29.506s	-1.334s (-4.3%) ⚪

✅ No significant change.

✅ Low variance (time: 1.3%, heap: 1.8%)

_{Commit: 59acfe8 · Baseline: cached · Runner: self-hosted bench}