perf: add L1 block body verification with tx inclusion proofs

[prajwolrg]

Description

Originally, we were using the following to check the validity of the bitcoin block body.

assert!(block.check_merkle_root() && block.check_witness_commitment());

While this works, this is really expensive for a full block because of the two main reasons:

1. ZkVMs have precompiles for RustCrypto sha2 function can't be used inside of the bitcoin because it's using sha2 from bitcoin-hashes instead.
2. Verifying the inclusion of the witness commitment in a coinbase transaction is sufficient instead of computing the merkle tree root again.

So in this PR:

1. Add coinbase Merkle inclusion proof (TxidInclusionProof) so SegWit blocks verify the coinbase against the Merkle root without recomputing the full tree — significant performance gain for ZK proof generation on large blocks.
2. Centralize SHA-256d operations (compute_txid, compute_wtxid, calculate_root) using RustCrypto's SHA-2 instead of the bitcoin crate internals, enabling SP1/Risc0 ZK prover acceleration via patched crates.
3. Extract error types into dedicated errors.rs with new L1BodyError enum and proper error propagation through AsmError::InvalidL1Body instead of panics.
4. Localize strata-btc-verification as a workspace crate (was an external git dependency)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature/Enhancement (non-breaking change which adds functionality or enhances an existing one)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor
• New or updated tests
• Dependency update
• Security fix

Notes to Reviewers

Checklist

• I have performed a self-review of my code.
• I have commented my code where necessary.
• I have updated the documentation if needed.
• My changes do not introduce new warnings.
• I have added tests that prove my changes are effective or that my feature works.
• New and existing tests pass with my changes.

Related Issues

[codecov]

Codecov Report

❌ Patch coverage is 95.98854% with 14 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/btc-verification/src/body_verification.rs	95.65%	5 Missing ⚠️
crates/btc-verification/src/inclusion_proof.rs	95.83%	3 Missing ⚠️
crates/proof/statements/src/moho_program/input.rs	92.50%	3 Missing ⚠️
crates/btc-verification/src/header_verification.rs	90.47%	2 Missing ⚠️
crates/btc-verification/src/utils_btc.rs	98.71%	1 Missing ⚠️

Files with missing lines	Coverage Δ
crates/btc-verification/src/timestamp_store.rs	91.56% <ø> (ø)
...rates/proof/statements/src/moho_program/program.rs	79.06% <100.00%> (+1.02%)	⬆️
crates/proof/statements/src/test_utils.rs	100.00% <100.00%> (ø)
crates/stf/src/stf.rs	100.00% <100.00%> (ø)
crates/worker/src/state.rs	75.59% <100.00%> (+0.72%)	⬆️
crates/btc-verification/src/utils_btc.rs	98.87% <98.71%> (-1.13%)	⬇️
crates/btc-verification/src/header_verification.rs	97.86% <90.47%> (-0.38%)	⬇️
crates/btc-verification/src/inclusion_proof.rs	95.83% <95.83%> (ø)
crates/proof/statements/src/moho_program/input.rs	94.82% <92.50%> (-2.80%)	⬇️
crates/btc-verification/src/body_verification.rs	95.65% <95.65%> (ø)

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Commit: 569d58a
SP1 Execution Results

program	cycles	success
ASM STF	140,954,513	yes
Moho Recursive	629,361	yes

[delbonis]

Really happy to see some of this aggressive optimization work like in the utils module, but then we go and make a bunch of easily avoidable allocs (and some which are still avoidable but which require a little more work)!

[delbonis]

Oh also consider using ExactSizeIterator in calculate_root. I can't imagine a scenario where we don't have it though.

[MdTeach]

Overall looks good!!
In future work we could still optimize more by migrating all tx.compute_txid() to use RustCrypto's sha2

[storopoli]

Overall looks good!! In future work we could still optimize more by migrating all tx.compute_txid() to use RustCrypto's sha2

Yes but be aware that is a double hash and you need to reverse the hex (thank you Satoshi for programming bitcoin in a Windows 32-bit machine).

[storopoli]

ACK dba5f7a