perf(bp): consolidate verify_agg into a single vendored MSM (closes #100)

Collapse secp256k1_bulletproof_verify_agg's two equality checks (the
range-relation LHS/RHS and the inner-product-collapsed P+IPA check)
into one mpt_msm_variable_time call that must return the identity.
Variable-time MSM dispatch via the vendored Pippenger/Straus ecmult
landed in PR #89 (mpt-crypto-msm-vendor); this PR consumes it.

Equation. With a fresh Fiat-Shamir batching weight c (BBB+18-style
random-linear-combination), the check E1 + c*E2 = 0 unrolls to a
(2n + 2*log n + m + 6)-term MSM plus an optional G coefficient
(t_hat - delta) passed via inp_g_sc_be32. The H_k coefficient absorbs
the y^{-k} factor that was previously applied to a separately-built
Hprime vector, and the per-term s_k product (the IPA fold weight) is
computed inline matching fold_generators()'s G-fold pattern; s_k^{-1}
matches the H-fold pattern, recomputed directly to avoid n scalar
inversions.

Soundness. c is bound to the entire proof (last IPA round challenge
+ tau_x + mu + a + b) via SHA-256 with the dedicated tag
"MPT_BP_VERIFY_BATCH_RLC". A malicious prover that makes E1 and E2
individually non-zero would need to predict c before committing the
proof; Schwartz-Zippel gives the standard 1/q bound. The c == 0 case
(~1/2^256) is explicitly rejected to keep the soundness reasoning
clean.

Perf (Apple M-series, m=2, n=128, 5-iteration avg):
  before: 10.0 ms
  after:   1.68 ms
  speedup: ~6x

This exceeds the 2-4x estimate in #100; the extra factor comes from
also folding the (m+4)-term range check and the rounds-many IPA
folding mults into the same MSM, where the constant-fan-out terms
contribute to the GLV/Pippenger amortisation.

Other changes.
* secp256k1_bulletproof_ipa_msm() is untouched; the prover's
  calculate_commitment_term() still routes through it. Verifier-only
  swap, prover CT contract preserved. The constant-time MSM profile
  for the prover is tracked separately in #87.
* Static helper ipa_verify_explicit() removed; tests/test_ipa.c
  carries its own copy of the round-by-round IPA-verify check.
* fold_generators() and apply_ipa_folding_to_P() retained because
  tests/test_ipa.c still uses them.

Tests. 11/11 ctest green (test_bulletproof_agg covers positive +
negative paths for m in {1, 2} including v=0, v=1, v=UINT64_MAX, and
the two tampered-commitment cases that exercise the rejection branch
of the consolidated MSM).

Author: tesseract-ripple