constraints: derive one sumcheck endpoint from the running claim

[TomWambsgans]

The round polynomial is h(Y) = eq(ζ_m, Y)·p(Y) + Y·u, and the verifier's first act is to check h(0) + h(1) = claim. That relation is an identity the prover can read backwards: one Boolean endpoint of the degree-2 cofactor p determines the other, so only one of them has to be evaluated over the rows.

Writing the two endpoints out, h(0) = (1+ζ_m)·p(0) and h(1) = ζ_m·p(1) + u. Evaluating p(1) and recovering p(0) = (claim + h(1))/(1+ζ_m) costs one field inversion per round instead of a pass over the half-table. The inverse does not exist at ζ_m = 1, where 1+ζ_m vanishes in characteristic two; there h(0) is zero outright and h(1) alone carries the claim, so the round evaluates p(0) and derives p(1) = claim + u with no division at all. Between the two branches every ζ_m is covered, so there is no fallback pass and no shape restriction.

Both nodes are still gathered, g being their interpolation, so what this removes is one of the three per-row identity evaluations, not one of three column reads. The transmitted four words are unchanged and the verifier is untouched.

A sampled ζ never lands on 1, so the flipped branch is unreachable in any end-to-end test; unit_eq_coordinates_verify pins it directly, at τ = 12 so the first round's half-table also lands exactly on PAR_THRESHOLD and covers the parallel reducer.

Measured against 86a75ba, interleaved A/B, 5 rounds of 3 passes per arm:

xmss --n-signatures 890 --log-inv-rate 1 3.641 s -> 3.549 s -92 ms (-2.53%), 5/5 rounds favorable
recursion --n 2 --log-inv-rate 2 1.425 s -> 1.370 s -55 ms (-3.86%), 5/5 rounds favorable

Idea from #5.