refactor: remove the TS AVM simulator (#24305)

## Summary

There were two AVM simulator implementations: the pure-TS one and the
C++ one. Production and tests already run on the C++ simulator, so this
removes the TS AVM simulator and the **TS↔C++** comparison/fuzzing
harnesses.

The opcode classes are kept (stripped to their encoder surface) so that
tests can still **build bytecode in TS and execute it with the C++
simulator** — they only ever used the opcode constructors +
serialization, never `execute()`. What remains of the encoder is
consolidated into a single `opcodes.ts` (plus the `Instruction` base).
Since the whole encoder is only reachable from tests, all of
`public/avm/` now lives under `avm/testing/`.

The Noir **SSA/brillig** differential fuzzer (brillig-vs-AVM) is kept
and re-pointed at the C++ simulator (see below).

Net: ~16k lines removed.

Part of
https://linear.app/aztec-labs/issue/A-1291/delete-old-avm-ts-simulator

## What's removed

- **TS AVM interpreter** — `AvmSimulator` and its execution engine:
`avm_context`, `avm_machine_state`, `avm_execution_environment`,
`avm_gas`, the memory runtime helpers, `avm_contract_call_result`,
`revert_reason`, `calldata`, `debug_fn_name`.
- **TS public-tx orchestration** — the TS `PublicTxSimulator`
(phases/reverts/fee/hint generation), `public_tx_context`,
`state_manager/`, `side_effect_trace`, `hinting_db_sources`, and the TS
measured/telemetry simulators.
- **Comparison harness** — `cpp_vs_ts_public_tx_simulator`, plus the
unused `cpp_public_tx_simulator_with_hinted_dbs`.
- **TS↔C++ differential fuzzer** — the C++ `avm_differential` entry
point and the entire JS-backed differential lib (`JsSimulator`,
`common/process`,
`FuzzerSimulationRequest`/`serialize_simulation_request`, the CPP-vs-JS
`compare_simulator_results`, and the `fuzz_against_ts_simulator` loop in
`fuzz_lib/fuzz.*`) that drove the TS simulator over `AVM_SIMULATOR_BIN`.
The `AVM_SIMULATOR_BIN` plumbing in `run_fuzzer.sh` is dropped with it.
- **TS-specific / execution tests** — per-opcode `execute()` tests,
interpreter tests, state-manager/side-effect-trace tests, and the TS
`PublicTxSimulator` test. The AVM-direct *apps* tests (which ran on the
deleted `AvmSimulationTester`) are not lost: their coverage is restored
on the C++ `PublicTxSimulationTester` (see commit 7).

## What's kept (and why)

- The opcode classes, `serialization/`, the memory-value types
(`TypeTag`/`Field`/`Uint*`), addressing encoding, and `errors` — the
**encoder surface** used by `custom_bc.test.ts`, `opcode_spam.test.ts`,
`minimal_public_tx`, and `opcode_spammer` to construct bytecode that is
executed by the C++ simulator. The opcode classes + `instruction_impl` +
`addressing_mode` are consolidated into one `opcodes.ts` (the
`Instruction` base stays separate), and the whole surface lives under
`avm/testing/` since nothing in production imports it.
- All C++ simulators (`CppPublicTxSimulator`, `Telemetry`/`Dumping`
variants) and the pure-C++ prover and per-opcode harness fuzzers.
- **The `tx` fuzzer** (`avm_fuzzer_tx_fuzzer`), rebuilt as a pure-C++
coverage fuzzer: `fuzz_tx` now runs `CppSimulator` only (catching
exceptions into a reverted result so sanitizer/assert failures stay the
only crashes). The `prover` fuzzer and its CPP-vs-CPP
`compare_cpp_simulator_results` (`fuzzer_comparison_helper`) are
untouched — that helper backs the prover, not the deleted JS path.
- **The SSA/brillig fuzzer** (`run_avm_brilling_fuzz.sh` → Noir's
cargo-fuzz `brillig` target). It uses `avm_simulator_bin.ts` as its AVM
oracle to compare **brillig (ACVM) vs AVM** — it is *not* a TS↔C++
fuzzer. It is restored with `AvmFuzzerSimulator` now wrapping
`CppPublicTxSimulator` instead of the TS simulator, so it compares
brillig against the **production** AVM. The stdio/msgpack protocol is
unchanged, so the cargo-fuzz harness is a drop-in.

A new slim `PublicTxSimulatorBase` (constructor, world-state/contract-DB
handles, config, logger, `computeTxHash`) is extracted so
`CppPublicTxSimulator` no longer inherits the TS orchestration.

## Commits

1. **`refactor(simulator): route public tx simulation through the C++
simulator only`** — extract `PublicTxSimulatorBase`, re-parent
`CppPublicTxSimulator`, switch every test consumer (shared
`PublicTxSimulationTester`, public-processor / public-tx apps tests,
ivc-integration) to the C++ simulator, drop the now-meaningless
`useCppSimulator` flag, and delete the comparison/dead/TS
measured+telemetry simulators. Behavior-preserving.
2. **`refactor(simulator): remove the TS AVM interpreter and
orchestration`** — delete the TS execution stack and orchestration,
strip the opcode classes to their encoder surface, and delete the
TS-specific/execution tests.
3. **`chore(bb): remove the TS<->C++ differential AVM fuzzers`** —
delete the `avm_differential`/`tx` fuzzer entry points and update
`run_fuzzer.sh`.
4. **`feat(simulator): restore the SSA/brillig AVM fuzzer on the C++
simulator`** — re-add `avm_simulator_bin.ts` / `AvmFuzzerSimulator` /
`run_avm_brilling_fuzz.sh`, now backed by `CppPublicTxSimulator`.
5. **`refactor(bb): drop JsSimulator and rebuild the tx fuzzer on the
C++ simulator`** — remove the JS-backed differential lib (`JsSimulator`,
`common/process`, `FuzzerSimulationRequest`,
`serialize_simulation_request`, CPP-vs-JS `compare_simulator_results`,
`fuzz_lib/fuzz.*`) and the `AVM_SIMULATOR_BIN` plumbing in
`run_fuzzer.sh`; restore `tx.fuzzer.cpp` (`avm_fuzzer_tx_fuzzer`)
running `CppSimulator` only. Keeps `fuzz_prover` +
`fuzzer_comparison_helper`.
6. **`refactor(simulator): consolidate AVM opcodes into one file and
move test helpers to testing/`** — merge the per-category opcode files,
`instruction_impl`, and `addressing_mode` into one `avm/opcodes.ts`
(keeping `Instruction` in `avm/instruction.ts`), and rename
`avm/fixtures/` → `avm/testing/` to match the repo's `src/testing/`
convention. Imports rewritten; no behavior change.
7. **`test(simulator): restore dropped AVM apps tests on the C++
simulator`** — re-add the `avm_test` cases that were dropped with the
AVM-direct tester (unique-contract-class limit: max passes / max+1
reverts, and nested-call exceptional-halt recovery), now driven through
`PublicTxSimulationTester`. Also restores `account_proof.json` (and its
mainnet fetcher) into `testing/` — `bench.test.ts`'s storage-proof test
reads it but it had been deleted, leaving that test broken. Token
coverage was already preserved via `tokenTest`.
8. **`refactor(simulator): move the AVM encoder under testing/ (it is
test-only)`** — the entire `public/avm` encoder surface is only consumed
by tests/fixtures (production runs through the C++ NAPI sim, which never
touches the TS encoder), so move
`opcodes.ts`/`instruction.ts`/`serialization/`/`avm_memory_types.ts`/`errors.ts`
into `avm/testing/`. Drop the dead `avm/index.ts` barrel and the unused,
now-stale `./public/avm/opcodes` package export.
9. **`test(simulator): drop the 'Cpp' benchmark prefix now that there is
one simulator`** — the `Cpp ` metric prefix only existed to separate the
C++ benchmark rows from the (removed) TS rows. With one simulator it's
redundant, so benchmark groups go back to `Token contract tests` /
`Opcode Spam` etc. The `setMetricsPrefix` grouping API is kept (it's the
general per-app grouping, also used by `bb-prover` proving tests).
**Benchmark note:** the un-prefixed series previously held TS-sim
numbers, so the C++ numbers now continue under those names — the
historical trend across the cutover is intentionally not
apples-to-apples.

## Verification

- `@aztec/simulator` builds; `yarn lint simulator` clean.
- Kept encoder unit tests pass (`avm/serialization/*.test.ts`, 12/12).
- Restored apps tests pass on the C++ simulator: `avm_test.test.ts` 4/4
(incl. the 3 re-added cases), `bench.test.ts` storage-proof test, and
`deployments.test.ts` 3/3.
- Downstream `@aztec/bb-prover` and `@aztec/ivc-integration` type-check
(they consume only the kept fixtures).
- The restored fuzzer bin builds, loads its native + world-state deps,
and round-trips its msgpack I/O loop; its happy path uses the same
`CppPublicTxSimulator.simulate()` exercised by the passing apps tests.
- No package outside `simulator` imports any removed symbol.
- **The C++ AVM fuzzer changes build and link locally** (`fuzzing-avm`
preset, clang-20): `avm_fuzzer_tx_fuzzer` (rebuilt on `CppSimulator`)
and `avm_fuzzer_prover_fuzzer` both compile, link, and load as libFuzzer
binaries — confirming no dangling references to the removed
`JsSimulator`/`process`/`compare_simulator_results`. The
`avm_differential` target is gone as intended. (This is stronger than
CI's syntax-only `fuzzing-avm` gate, which doesn't link.)

## Notes for reviewers

- **Barretenberg C++ was built locally** (commits 3 and 5): the
`fuzzing-avm` preset configures and the affected fuzzers
(`avm_fuzzer_tx_fuzzer`, `avm_fuzzer_prover_fuzzer`) compile + link
cleanly with clang-20. Commit 3 removes the differential fuzzer entry
points; commit 5 removes the now-orphaned JS-backed lib and rebuilds the
`tx` fuzzer on `CppSimulator`. `fuzzer_comparison_helper` is **kept** —
its `compare_cpp_simulator_results` backs the (untouched) `prover`
fuzzer, not the deleted JS path.
- A full happy-path run of the SSA/brillig fuzzer needs the cargo-fuzz
harness (a nightly Rust + `cargo-fuzz` toolchain), not run here.
- Some retained data structures (`TaggedMemory` runtime ops,
`Addressing.resolve`) are now unused by the encoder path and could be
slimmed in a later cleanup.

Author: fcarreiro

barretenberg/cpp/src/barretenberg/avm_fuzzer/avm_differential.fuzzer.cpp

@@ -68,7 +68,7 @@ class FuzzerWorldStateManager {
     static constexpr const char* DATA_DIR = "/tmp/avm_fuzzer_ws/world_state";
     static constexpr uint64_t MAP_SIZE_KB = 10240; // 10 MB
 
-    // Static instance management (similar to JsSimulator pattern)
+    // Static singleton instance management
     static void initialize()
     {
         if (instance == nullptr) {

barretenberg/cpp/src/barretenberg/avm_fuzzer/common/interfaces/dbs.hpp

@@ -4,7 +4,6 @@
 #include "barretenberg/avm_fuzzer/common/interfaces/dbs.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/constants.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/control_flow.hpp"
-#include "barretenberg/avm_fuzzer/fuzz_lib/fuzz.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/fuzzer_context.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/fuzzer_data.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/instruction.hpp"