feat(public_checks): demote to non-protocol contract

[dbanks12]

Stacked on top of #23197 (which stacks on #23106). Mirrors the auth_registry and multi_call_entrypoint demotions but with a Noir-side stamp because public_checks::utils::privately_check_* is consumed by Noir app contracts (app_subscription, crowdfunding).

Summary

• Moves public_checks_contract from contracts/protocol/ to contracts/canonical/ (preserves git rename history).
• Restructures the canonical_addresses Noir crate so lib.nr is now a hand-written aggregator that re-exports per-contract stamps. auth_registry.nr (renamed from lib.nr) holds AUTH_REGISTRY_ADDRESS; public_checks.nr holds the new PUBLIC_CHECKS_ADDRESS. Downstream use canonical_addresses::FOO_ADDRESS imports keep their flat paths.
• Updates public_checks::utils to import canonical_addresses::PUBLIC_CHECKS_ADDRESS; adds canonical_addresses as a direct Nargo dep of public_checks_contract (transitive dep through aztec wasn't enough for nargo's import resolver).
• Removes PUBLIC_CHECKS_ADDRESS from constants.nr / aztec_constants.hpp / constants_gen.pil / constants.gen.ts / constants.in.ts whitelists and drops the entry from protocol_contracts.json. Address slot 6 in ProtocolContractsList becomes reserved (zero).
• Adds a public-checks stamp sub-package to @aztec/canonical-contracts with both Noir lib renderer and TS twin, plus a freshness test.
• Renderer wrap fix: the existing auth-registry and multi-call-entrypoint TS twin renderers also wrap their long export lines in this PR, because the pre-commit prettier hook re-wraps any committed .ts file (which previously caused the freshness assertion to flap between renderer-output and on-disk versions). This is a one-time fix that lets the freshness gate be stable for all three stamps; the on-disk Noir/TS twin files are correspondingly regenerated.
• Adds noir-projects/scripts/public_checks_cycle_guard.sh (mirrors the auth_registry guard). It accepts the structural dep (unlike auth_registry's) because the contract crate must export utils.nr for consumer contracts, but it still fails if the bytecode embeds the stamped address.
• Drops the public-checks/ subdir from @aztec/protocol-contracts, the PublicChecksContract re-export from aztec.js, and the entries in the bundle/lazy providers.

Derived address

PUBLIC_CHECKS_ADDRESS = 0x0ed9aa9b8262bd0afb923764799e058ad10cf0de3e01dcf955055b11fdb20d70

(class id 0x1853dc3b22d13d7fb93a089c366125098bf0f4a169255e12fc3765b3c08c3b6d matches the prior protocol-contract class id for PublicChecks; only the address moves from the magic 6 to the artifact-derived value.)

Test plan

• Local: yarn workspace @aztec/canonical-contracts test — all 15 tests pass (auth_registry, multi_call_entrypoint, and public_checks freshness gates).
• Local: nargo compile --package {public_checks_contract,app_subscription_contract,crowdfunding_contract} — all succeed.
• Local: noir-projects/scripts/public_checks_cycle_guard.sh — public_checks cycle guard: ok.
• CI: e2e suites covering crowdfunding/subscription public checks usage.

[dbanks12]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(public_checks): demote to non-protocol contract #23199 👈 (View in Graphite)
• feat!: demote multi_call_entrypoint to non-protocol contract #23197 : 1 other dependent PR (#23218 )
• feat!: demote public_checks to non-protocol contract #23217
• feat!: demote auth registry to non-protocol contract #23106
• refactor: move public_checks caller helpers into aztec-nr #23215
• merge-train/fairies

This stack of pull requests is managed by Graphite. Learn more about stacking.