Dynamic spread table width + Ch algebraic optimization

[rose2221]

Summary

• Replaces the hardcoded 8-bit spread table with a cost-model-driven dynamic width selection. A new calculate_spread_witness_cost function estimates total witness cost across table overhead, inline witnesses, and LogUp queries for each candidate width (2–20 bits), and get_optimal_spread_width picks the minimum. All spread internals are generalized from fixed 4-byte chunks to variable-width chunks (subchunks, spread_decompose, pack_chunks, spread_from_chunk_spreads). The chosen width is displayed in circuit_stats output.

• Reduces Ch(e,f,g) from 3 spread_decompose calls to 2 + one algebraic constraint, using the identity Ch = (e&f) + g - (e&g). Saves ~39 witnesses/round (~2,496/compression) from eliminated spread decomposition and lookups. Dead code removed: spread_not_terms, spread_from_chunk_spreads, SPREAD_ALL_ONES.

Benchmarks

35 SHA256 compressions (spread width: 8-bit → 16-bit)

Metric	Before	After	Reduction
Constraints	445,739	328,739	-26.3%
Witnesses	1,033,576	705,076	-31.8%

1 SHA256 compression (spread width: 8-bit → 11-bit)

Metric	Before	After	Reduction
Constraints	14,389	11,561	-19.7%
Witnesses	31,680	25,475	-19.6%