chore(avm): attacker-simulation tests for shift/unshift row-0 guarantees

[jeanmon]

Add two AvmVerifierTests cases that simulate a malicious prover injecting a non-zero value into keccak_memory_addr polynomials in positions the proving system is expected to structurally enforce as zero:

• ProvingSystemSecurityShiftedLastRowMustBeZero (active): forges addr_shift at row N-1 by overwriting the shifted view with an independent polynomial after AvmProver construction. The PCS shift-consistency check catches the mismatch and verification fails.

• DISABLED_ProvingSystemSecurityUnshiftedFirstRowMustBeZero (disabled): same pattern for the unshifted polynomial at row 0. Kept disabled because it requires relaxing two safeguards in polynomials/polynomial.cpp (Polynomial::add_scaled / operator+= and Polynomial::shifted); the test comment documents the exact patches needed and why, for later audit reproduction.

Both tests invoke run_check_circuit on a separate ProverPolynomials instance holding the same malicious mutation to demonstrate that every main/lookup/permutation relation still holds on the attacker's trace -- so the verifier's rejection comes from the PCS shift algebra, not from a relation violation.