Fix: Remove manual witness allocation in SHA256 compression

[shreyas-londhe]

Problem

SHA256 compression functions were manually allocating witnesses and pushing builders, bypassing the standard add_witness_builder() flow. This caused R1CS to allocate more witnesses than builders tracked, resulting in unused witness slots being filled with random values.

Root cause:

// Bad: Manual allocation
let witness = r1cs_compiler.num_witnesses();
r1cs_compiler.r1cs.add_witnesses(1);
r1cs_compiler.witness_builders.push(builder);  // Bypasses tracking

Solution

Replace manual allocations with add_witness_builder() to maintain consistency between R1CS witness count and builder tracking.

Affected functions:

• add_u32_addition (lines 36-50, 103-108, 120-125)
• add_ch (lines 358-363)

Impact

• Eliminates wasted witness slots
• Maintains correctness of SHA256 constraints

Testing

Verified on passport validity circuit: witness count now matches builder count exactly (3,358,873 witnesses, 0 random fills from SHA256).