zeroed_fe_vec: reinterpret via from_raw_parts, not Vec transmute

[MauroToscano]

Small hardening of the zeroed_fe_vec helper added in the opt commit (calloc-backed zeroed trace buffers). No behavior change — pure implementation swap.

Why

The helper reinterpreted its calloc'd buffer with:

unsafe { core::mem::transmute::<Vec<u64>, Vec<FE>>(zeros) }

Transmuting one Vec to another relies on Vec's field layout being identical across element types. Vec is #[repr(Rust)] (unspecified layout, permitted to depend on the element type), so this isn't guaranteed by the language — the std mem::transmute docs call out this exact Vec→Vec pattern as a Bad Idea and recommend from_raw_parts. It's sound on the pinned rustc 1.94.0 (no layout randomization), but e.g. -Zrandomize-layout could permute {ptr, cap} differently for the two types and make it UB.

What

Rebuild the Vec<FE> from (ptr, len, cap) on the same allocation:

let mut zeros = core::mem::ManuallyDrop::new(zeros);
unsafe { Vec::from_raw_parts(zeros.as_mut_ptr() as *mut FE, zeros.len(), zeros.capacity()) }

Same calloc'd buffer, same element size/align (already const-asserted), so the eventual dealloc Layout matches exactly and there's no dependence on Vec's internal layout. The FE-is-u64 / zero-is-all-zero justification is unchanged and stays self-contained in the helper (no coupling to the disk-spill SpillSafe trait — deliberately, since that's a separate, feature-scoped concern).

Testing

Full cargo test -p lambda-vm-prover --lib: 503 passed (only the 5 known missing rust-guest ELF fixtures fail, at file-read). The zeroed_fe_vec_matches_fe_zero guard test and end-to-end prove+verify pass, confirming byte-identical behavior. make lint, clippy --all-targets, fmt --check clean.