Review fixes for #758: dedupe private-input page math, drop leaky serde derives, fix stale CLI README

[MauroToscano]

Motivation

Follow-up to the review of #758. Five findings surfaced: one stale doc directly contradicting the PR, duplicated security-critical page math, dead serde derives on the value-carrying boundary types, a dead verifier-side data lookup, and an inconsistent malformed-bundle error signal.

Description

• Stale CLI README (bin/cli/README.md): still claimed the serialized continuation proof includes the raw private input bytes so the verifier can rebuild genesis — the exact behavior Fix(Continuations): Make private input private #758 removes. Rewritten to describe the count-only bundle, with the non-ZK caveat kept (committed columns are still opened at STARK query positions).
• Single source of truth for private-input page math: private_input_page_count, is_private_input_page, private_input_page_bases, and max_private_input_pages now live in tables::page, used by the monolithic trace builder, the monolithic verifier bound, and the continuation prover/verifier. Previously the same 4 + len wire-format math was re-derived independently in trace_builder.rs, lib.rs, and continuation.rs (kept in lockstep only by comments); a drift would make one path build a private page preprocessed while the other commits it. Also adds PRIVATE_INPUT_LENGTH_PREFIX_BYTES to executor::vm::memory next to the wire-format writer, replacing the bare 4s.
• Drop unused serde derives on InitClaim/FiniClaim/CellBoundary: nothing serializes them since the bundle dropped EpochProof.boundary, and InitClaim.value is a private-input byte for a private first-read. With the derives gone, re-introducing that leak is a compile error instead of a silent regression.
• Verifier-side private-page config is explicitly data-free: global_memory_configs_from_init_page_data takes an include_private_genesis flag; the verifier passes false (its AIR never consults init_values and its image is ELF-only), removing a dead lookup that could silently start mattering if with_private_input ever grew data-dependent logic.
• Consistent malformed-bundle signal: a non-page-aligned touched_page_bases entry is now Err(Error::MalformedContinuationBundle) instead of Ok(None), matching the count bound's Err(InvalidTableCounts) — structural validation of untrusted bundle fields is an error, Ok(None) is reserved for well-formed proofs that fail verification. Test updated accordingly.

No constraint, statement, or serialization-format changes; behavior is identical except the error variant for hand-crafted non-aligned bundles.

Testing

• cargo test -p executor --lib — 27/27
• cargo test -p lambda-vm-prover private_input — 14/14 (incl. multipage, after make compile-programs-asm)
• cargo test -p lambda-vm-prover -- touched_page_base continuation_global_state local_to_global — 32/32
• cargo clippy --all-targets clean on both crates