perf(bp): collapse aggregated verifier into single vendored MSM

[tesseract-ripple]

Closes #100. Stacked on #89 (vendored mpt_msm_variable_time); the
last commit (2cd20ac9) is the only #100 change. Review just that
commit — the preceding commit is #89's vendor as already up for
review there.

What

Collapses secp256k1_bulletproof_verify_agg's two equality checks
(the range-relation LHS == RHS and the inner-product-collapsed
P + sum L,R == a*Gf + b*Hf + a*b*ux*U) into a single
mpt_msm_variable_time call that must return the identity.

Equation

With a fresh Fiat–Shamir batching weight $c$ (BBB+18-style RLC), the
check $E_1 + c \cdot E_2 = 0$ unrolls to a
$(2n + 2 \log n + m + 6)$-term MSM plus an optional $G$ coefficient
$t_{\hat{}} - \delta$ passed via inp_g_sc_be32. The $H_k$ coefficient
absorbs the $y^{-k}$ factor that the previous code applied via a
separately-built Hprime vector. The per-term $s_k$ product (the
IPA fold weight) is computed inline matching fold_generators()'s
G-fold pattern; $s_k^{-1}$ matches the H-fold pattern, recomputed
directly to avoid $n$ scalar inversions.

Soundness

$c$ is bound to the entire proof (u_{rounds-1} + tau_x + mu +
a + b) via SHA-256 with the dedicated tag
MPT_BP_VERIFY_BATCH_RLC. A malicious prover that makes $E_1$ and
$E_2$ individually non-zero would need to predict $c$ before committing
the proof; Schwartz–Zippel gives the standard $1/q$ bound. The
$c = 0$ case ($\sim 1/2^{256}$) is explicitly rejected to keep the
soundness reasoning clean.

Perf (Apple M-series, m=2, n=128, 5-iteration avg)

	verify time
before (vendor-msm-pippenger tip)	10.0 ms
after (this PR)	1.68 ms
speedup	~6×

Exceeds the 2–4× estimate in #100; the extra factor comes from also
folding the $(m+4)$-term range check and the $\log n$ IPA folding
mults into the same MSM (where the constant-fan-out terms contribute
to the GLV/Pippenger amortisation).

Other changes

• secp256k1_bulletproof_ipa_msm is untouched. The prover's
  calculate_commitment_term still routes through the per-term loop,
  preserving the prover CT contract. The constant-time MSM profile
  for the prover is tracked separately in mpt_msm_constant_time: constant-time MSM profile for the prover path #87.
• The static helper ipa_verify_explicit is removed; tests/test_ipa.c
  carries its own copy of the round-by-round IPA verify check.
• fold_generators and apply_ipa_folding_to_P are retained because
  tests/test_ipa.c still calls them.

Tests

11/11 ctest green. test_bulletproof_agg exercises positive and
negative paths for $m \in {1, 2}$ including $v = 0$, $v = 1$,
$v = \text{UINT64_MAX}$, and the two tampered-commitment cases that
trigger the rejection branch of the consolidated MSM.

Out of scope (tracked separately)

• Batched multi-proof verification via BBB+18 §6.1 generator stacking: *_verify_batch: batched verification for compact sigma + aggregated BP #88.
• Prover-side constant-time MSM: mpt_msm_constant_time: constant-time MSM profile for the prover path #87.
• rippled-side integration.