refactor: separate precompile verification from proving

[huitseeker]

• miden-verifier now uses miden-precompiles-verifier. Shared AIR code is in miden-precompiles-air.
• All proving work remains in miden-precompiles-prover: verifier users do not build prover code.

This completes the crate split discussed in #2282. #3222 created the runtime crate. #3293 and #3343 added the first PVM proof path. #3467 added the MASM verifier input adapter. #3672 settled the MASM package layout. The verifier split was left until that work was complete.

• Existing PVM proof bytes still verify when their registry root matches.
• The relation digest, preprocessed commitment, ACE registry root, AIR order, and proof encoding are unchanged.
• A pinned proof from before the split verifies with its recorded root and fails with a different root.

Closes #2282

[Al-Kindi-0]

Looks good, modulo the change log entry

[bobbinth]

We'll need to set up trusted publishing for precompiles-air and precompiles-verifier crates.

Also question: is the reason crates/lib/core/codegen mixed in between the precompiles crates because it is related to precompiles?

Also also, after this PR, may be a good time to update the Project structure section in the main README as it has become quite outdated.

[huitseeker]

1. The current position of crates/lib/core/codegen is historical: it used to be precompiles/codegen, and I will move it next to crates/lib/core.
2. For miden-precompiles-air and miden-precompiles-verifier, recall you need to publish one version of each with an API token. Then you just need to add a trusted publisher for repository 0xMiden/miden-vm and workflow workspace-publish.yml, using the release environment.