multisig-glue: update leanMultisig to 2eb4b9d (fix-avx512)

[ch4r10t33r]

Summary

• Updates leanMultisig dependency from 2dc7867 to 2eb4b9d (Devnet4 fix-avx512 (#194))
• Fixes index out of bounds: the len is 0 but the index is 0 panic in split_eq.rs:85 that caused 3 aggregation-related tests to abort with SIGABRT on CI
• The upstream fix addresses AVX512 panics on small instances and adds a test_aggregation test

Failing tests this fixes

• forkchoice.test.aggregate prunes attestation signatures
• lib.test.apply transition on mocked chain
• aggregation.test.aggregateSignatures and verifyAggregatedPayload with valid and invalid public_key/ message/ epoch

Test plan

• CI unit tests pass (the 3 previously failing tests should now pass)
• risc0 CI prover passes

[zclawz]

LGTM — straightforward upstream bump with a clear upstream rationale.

What changed upstream (2dc7867 → 2eb4b9d):
One merge commit in leanMultisig devnet4 branch:

• leanMultisig#192: Poseidon AVX2/AVX512 SIMD implementation
• leanMultisig#193: fix avx512 (panicked on small instances) — fixes an upstream panic in the AVX512 code path when run on small proof instances, which is the root cause of the issue zeam-side PR #724 was working around with catch_unwind

zeam diff is purely mechanical:

• multisig-glue/Cargo.toml: rev bumped on all 3 leanMultisig deps (rec_aggregation, leansig_wrapper, backend) ✅
• Cargo.lock: all leanMultisig crates (backend, lean_compiler, lean_prover, lean_vm, leansig_wrapper, mt-*, rec_aggregation, sub_protocols, utils) updated to new rev ✅
• Registry deps: bitflags 2.11.0 → 2.11.1 (minor patch, transitive), rustls-webpki 0.103.11 → 0.103.12 (security/patch) — both expected from a cargo update during the lock regeneration ✅

Together with #724 (catch_unwind) and #729/#735 (x86-64-v3 RUSTFLAGS), this closes the AVX512 panic from multiple angles. Approved. 🚢