feat: reduce CRS and polynomial memory for non-ZK proofs (#20731)

## Summary
- Size the CRS at `max_end_index` (actual data extent) rather than
`dyadic_size` for non-ZK proofs
- Make Shplonk quotient polynomial `round_up_power_2` conditional on
having non-dyadic claims (Libra/sumcheck), which only exist in the ZK
path
- Size PolynomialBatcher's temporary polynomials (`batched_unshifted`,
`batched_to_be_shifted`, `A_0_pos`, `A_0_neg`) at `actual_data_size`
rather than `full_batched_size`

## Benchmark results

Chonk AMM flow (`ecdsar1+amm_add_liquidity_1_recursions+sponsored_fpc`),
`max_end_index=278,429` vs `dyadic_size=524,288`:

```
bb prove --scheme chonk --ivc_inputs_path .../ecdsar1+amm_add_liquidity_1_recursions+sponsored_fpc/ivc-inputs.msgpack -o /tmp/out
```

| | Run 1 (KB) | Run 2 (KB) | Run 3 (KB) | Avg (MiB) |
|---|---|---|---|---|
| Before | 702,660 | 704,044 | 691,328 | 682.7 |
| After  | 657,096 | 672,916 | 677,508 | 654.8 |
| **Savings** | **45,564** | **31,128** | **13,820** | **~28 MiB
(~4.1%)** |

## Test plan
- [x] `ultra_honk_bench` at 2^20 passes (no crash)
- [x] `ultra_honk_tests`: 260 passed, 5 skipped
- [x] `commitment_schemes_tests`: 82 passed, 2 skipped
- [ ] CI passes

Author: johnathan79717

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini.hpp

@@ -125,6 +125,7 @@ template <typename Curve> class GeminiProver_ {
     class PolynomialBatcher {
 
         size_t full_batched_size = 0; // size of the full batched polynomial (generally the circuit size)
+        size_t actual_data_size_ = 0; // max end_index across all polynomials (actual data extent)
 
         Polynomial batched_unshifted;            // linear combination of unshifted polynomials
         Polynomial batched_to_be_shifted_by_one; // linear combination of to-be-shifted polynomials
@@ -133,10 +134,11 @@ template <typename Curve> class GeminiProver_ {
         RefVector<Polynomial> unshifted;            // set of unshifted polynomials
         RefVector<Polynomial> to_be_shifted_by_one; // set of polynomials to be left shifted by 1
 
-        PolynomialBatcher(const size_t full_batched_size)
+        PolynomialBatcher(const size_t full_batched_size, const size_t actual_data_size = 0)
             : full_batched_size(full_batched_size)
-            , batched_unshifted(full_batched_size)
-            , batched_to_be_shifted_by_one(Polynomial::shiftable(full_batched_size))
+            , actual_data_size_(actual_data_size == 0 ? full_batched_size : actual_data_size)
+            , batched_unshifted(actual_data_size_, full_batched_size)
+            , batched_to_be_shifted_by_one(Polynomial::shiftable(actual_data_size_, full_batched_size))
         {}
 
         bool has_unshifted() const { return unshifted.size() > 0; }
@@ -191,8 +193,8 @@ template <typename Curve> class GeminiProver_ {
          */
         std::pair<Polynomial, Polynomial> compute_partially_evaluated_batch_polynomials(const Fr& r_challenge)
         {
-            // Initialize A₀₊ and compute A₀₊ += F as necessary
-            Polynomial A_0_pos(full_batched_size); // A₀₊
+            // Initialize A₀₊ with only the actual data extent; virtual zeroes cover the rest
+            Polynomial A_0_pos(actual_data_size_, full_batched_size); // A₀₊
 
             if (has_unshifted()) {
                 A_0_pos += batched_unshifted; // A₀₊ += F

barretenberg/cpp/src/barretenberg/commitment_schemes/shplonk/shplonk.hpp

@@ -61,10 +61,6 @@ template <typename Curve> class ShplonkProver_ {
                 max_poly_size = std::max(max_poly_size, claim.polynomial.size());
             }
         }
-        // The polynomials in Sumcheck Round claims and Libra opening claims are generally not dyadic,
-        // so we round up to the next power of 2.
-        max_poly_size = numeric::round_up_power_2(max_poly_size);
-
         // Q(X) = ∑ⱼ νʲ ⋅ ( fⱼ(X) − vⱼ) / ( X − xⱼ )
         Polynomial Q(max_poly_size);
         Polynomial tmp(max_poly_size);

barretenberg/cpp/src/barretenberg/flavor/prover_polynomials.hpp

@@ -64,6 +64,16 @@ class ProverPolynomialsBase : public AllEntitiesBase {
         }
     }
 
+    // Returns the maximum end_index across all polynomials (i.e. the actual data extent)
+    [[nodiscard]] size_t max_end_index() const
+    {
+        size_t result = 0;
+        for (const auto& poly : this->get_all()) {
+            result = std::max(result, poly.end_index());
+        }
+        return result;
+    }
+
     void increase_polynomials_virtual_size(const size_t size_in)
     {
         for (auto& polynomial : this->get_all()) {

barretenberg/cpp/src/barretenberg/polynomials/polynomial.cpp

@@ -186,8 +186,13 @@ template <typename Fr> Polynomial<Fr>& Polynomial<Fr>::operator+=(PolynomialSpan
 
 template <typename Fr> Fr Polynomial<Fr>::evaluate(const Fr& z) const
 {
-    BB_ASSERT(size() == virtual_size());
-    return polynomial_arithmetic::evaluate(data(), z, size());
+    // Evaluate only the backing data; virtual zeroes beyond backing contribute nothing.
+    // When start_index > 0, multiply by z^start_index to account for the offset.
+    Fr result = polynomial_arithmetic::evaluate(data(), z, size());
+    if (start_index() > 0) {
+        result *= z.pow(start_index());
+    }
+    return result;
 }
 
 template <typename Fr> Fr Polynomial<Fr>::evaluate_mle(std::span<const Fr> evaluation_points, bool shift) const

barretenberg/cpp/src/barretenberg/ultra_honk/oink_prover.cpp

@@ -22,7 +22,7 @@ namespace bb {
 template <typename Flavor> void OinkProver<Flavor>::prove()
 {
     BB_BENCH_NAME("OinkProver::prove");
-    commitment_key = CommitmentKey(prover_instance->dyadic_size());
+    commitment_key = CommitmentKey(prover_instance->polynomials.max_end_index());
     send_vk_hash_and_public_inputs();
     commit_to_masking_poly();
     commit_to_wires();

barretenberg/cpp/src/barretenberg/ultra_honk/ultra_prover.cpp

@@ -60,8 +60,15 @@ template <typename Flavor> void UltraProver_<Flavor>::generate_gate_challenges()
 
 template <typename Flavor> typename UltraProver_<Flavor>::Proof UltraProver_<Flavor>::construct_proof()
 {
-    size_t key_size = prover_instance->dyadic_size();
+    // The CRS only needs to accommodate the actual data extent (max_end_index) rather than the
+    // full dyadic_size. All committed polynomials fit within this bound: witness/selector polys
+    // have backing ≤ max_end_index, Gemini fold polys have size ≤ dyadic_size/2 < max_end_index,
+    // Shplonk quotient Q is sized at max(claim sizes), and KZG opening proof is sized at Q.size().
+    // For ZK, the gemini_masking_poly (at dyadic_size) is already reflected in max_end_index.
+    size_t key_size = prover_instance->polynomials.max_end_index();
     if constexpr (Flavor::HasZK) {
+        // SmallSubgroupIPA commits fixed-size polynomials (up to SUBGROUP_SIZE + 3). Ensure the
+        // CRS is large enough for tiny test circuits where max_end_index may be smaller.
         constexpr size_t log_subgroup_size = static_cast<size_t>(numeric::get_msb(Curve::SUBGROUP_SIZE));
         key_size = std::max(key_size, size_t{ 1 } << (log_subgroup_size + 1));
     }
@@ -120,7 +127,7 @@ template <typename Flavor> void UltraProver_<Flavor>::execute_pcs()
 
     auto& ck = commitment_key;
 
-    PolynomialBatcher polynomial_batcher(prover_instance->dyadic_size());
+    PolynomialBatcher polynomial_batcher(prover_instance->dyadic_size(), prover_instance->polynomials.max_end_index());
     polynomial_batcher.set_unshifted(prover_instance->polynomials.get_unshifted());
     polynomial_batcher.set_to_be_shifted_by_one(prover_instance->polynomials.get_to_be_shifted());