Constraint restructure

[gabriel-barrett]

Constraint restructure: circuits as data, not code

Replaces the Plonky3/uni-stark-inherited builder machinery with a first-class
expression IR. A circuit is now data — vectors of constraint expressions plus
lookups — and the prover, verifier and debug checker become interpreters of a
single compiled form. Design doc: multi-stark-restructure.org.

Motivation

The old constraint path was inherited from uni-stark and paid for it:

• One circuit, four builders. Every AIR was evaluated against
  SymbolicAirBuilder, ProverConstraintFolder, VerifierConstraintFolder and
  DebugConstraintBuilder — four impls of AirBuilder + ExtensionBuilder +
  TwoStagedBuilder, with a constraint's meaning smeared across all of them.
• Viral generics. System<SC, A> carried the AIR type parameter; mixing
  heterogeneous circuits in one system forced artificial enums.
• Constraints were code, not data — they couldn't be serialized, hashed,
  inspected, or built across the FFI boundary.
• Interpretation was expensive. SymbolicExpression is a boxed tree:
  pointer-chasing per row, allocation-heavy construction, and repeated
  recomputation of shared subexpressions (selector products, lookup
  fingerprints, the accumulator expression LookupAir::eval cloned into two
  constraints).
• Hidden constraint synthesis. LookupAir::eval generated the stage-2
  constraints imperatively inside the builder callback, so a circuit's actual
  constraint set existed nowhere as an object.

What changed

A circuit is defined by data (expr.rs): a vector of base-field constraints,
a vector of extension-field constraints (primitives are fixed-size-D arrays),
and a vector of lookups (multiplicity + argument expressions). The window is the
current and next row only.

Two layers. An ergonomic frontend (Expr / ExtExpr) used only at
construction time, compiled once when the system is built into a flat format
(circuit.rs) that is the only thing the prover/verifier/checker ever touch:

• base-field only — extension constraints are coordinate-expanded into D
  base constraints at compile time (Karatsuba for D=2, schoolbook otherwise);
• hash-consed with commutative normalization — structurally equal
  expressions get equal NodeIds, so shared work is computed once per row and
  index equality doubles as structural equality;
• constant-folded and canonicalized — const-zero roots dropped, const-nonzero
  roots rejected (UnsatisfiableConstant), survivors sorted and deduped, so the
  compiled constraint set is independent of authoring order/multiplicity.

One evaluation semantics, several contexts (eval.rs). A dense forward sweep
over the topologically-ordered nodes (one buffer slot per node), generic over the
working type W: Algebra<F> + Copy — PackedVal for the prover, EF for the
verifier, Val for the debug checker/lookup witness. The hot loop uses an
unchecked sweep pinned by the topological invariant.

logUp synthesis is now data (lookup.rs). synthesize_lookups produces the
stage-2 running-accumulator constraints as ordinary ExtExprs that are appended
to a circuit and compiled like any other constraint — no imperative generation
inside a builder callback.

Generics gone. System<SC, A> → System<SC>; circuits are heterogeneous
values with no AIR type parameter and no artificial enums.

The protocol is unchanged — transcript, commitments, lookup argument, quotient
and FRI all behave as before. d67ca36 flips the prover/verifier over to the
compiled path and deletes the AIR path; 789d677 (a head-to-head AIR-vs-IR bench)
gated that cutover and is removed with it.

Removed

• src/builder/ — symbolic.rs, folder.rs, check.rs, mod.rs
  (SymbolicExpression, the three folders, the builder traits).
• src/test_circuits/ — blake3.rs, u32_add.rs, byte_operations.rs,
  baby_bear_config.rs. Coverage moves to src/tests.rs (compile/eval/
  canonicalization/lookup-synthesis + end-to-end prove/verify), and the
  examples/ are ported to the new API.

Test plan

• cargo test — new src/tests.rs plus the ported examples; e2e prove/verify.
• cargo clippy --all-targets and cargo fmt --check clean.