v0.5.0

This release follows draft-34 of the Bandersnatch VRF specification.

• RingContext struct for lightweight ring proof parameter caching.
  Contains only the PIOP parameters needed for prover/verifier instance construction, without the KZG SRS required for key construction.
• Multi-ring batch verification: a single ring::BatchVerifier can now aggregate proofs from multiple rings sharing the same KZG SRS into one batched pairing check.
• ring::BatchItem::new(verifier, ios, ad, proof) and pedersen::BatchItem::new(ios, ad, proof) constructors for preparing batch items independently of any verifier instance.

Changed

• Bump w3f-ring-proof dependency to 0.0.8.
• RingProofParams renamed to RingSetup.
• Suite::SUITE_ID is now a self-describing byte string (e.g.
  b"Bandersnatch-SHA512-ELL2-v1") used directly as the transcript seed and hash-to-curve DST prefix, replacing the structured 4-byte SuiteId { version, curve, hash, h2c }. Transcript::new now takes &[u8]. Breaking change for custom Suite implementations.
• Hash-to-curve DST unified to SUITE_ID || DomSep::HashToCurve for both Try-And-Increment and Elligator2 paths, replacing the prior "ECVRF_" || h2c_suite_id || suite_bytes form. hash_to_curve_ell2_xmd and hash_to_curve_ell2_xof no longer take a separate h2c_suite_id argument. DomSep::HashToCurveTai is renamed to HashToCurve and shared across both paths; ThinBatch/PedersenBatch collapse into a single BatchVerify.
• DigestXof counter widened from u32 to u64.
• Per-suite BLINDING_BASE, ACCUMULATOR_BASE, PADDING points and all test vectors regenerated under the new DSTs; previous values do not verify.

Removed

• RingProofParams::verifier_no_context method, superseded by RingContext::new.
• ring::BatchVerifier::prepare and pedersen::BatchVerifier::prepare, superseded by BatchItem::new constructors.
• SuiteId struct and the curve/hash/h2c constant modules under suites, superseded by the byte-string SUITE_ID.