Mode-explicit verification, y_com accessor, hardened arkworks deserialization

[0xAndoroid]

Summary

Implements SPEC.md — closing the Dory/Jolt boundary issues surfaced in the Jolt review.

• Explicit proof mode: verify_with_mode<…, Mo> is the new primitive; verify_transparent and verify_zk are convenience wrappers; verify remains as a documented autodetect/compat entry point. Cross-mode proofs (and partial ZK proofs) are rejected before any transcript challenge that depends on optional fields is drawn.
• y_com ownership: DoryProof::y_com() accessor (and is_zk / is_transparent / zk_fields_present / zk_fields_absent) make the proof the single source of truth for the evaluation hiding commitment. Outer protocols MUST bind to this value.
• Strict ArkGT deserialization: rejects Fq12::ZERO and any element outside the BN254 r-torsion subgroup (inner.pow(Fr::MODULUS) == Fq12::ONE). The check covers both DoryDeserialize and arkworks CanonicalDeserialize paths — the derive on ArkGT was removed and replaced with a manual impl so proofs deserialized through <ArkDoryProof as CanonicalDeserialize> validate inner GT fields too.
• Bounded proof deserialization: MAX_SERIALIZED_PROOF_ROUNDS = 64 rejects oversized num_rounds before any per-round Vec::with_capacity allocation. validate_serialized_proof_shape also enforces nu ≤ sigma, sigma == num_rounds, and overflow-safe nu + sigma / sigma < usize::BITS.
• Bonus (out of SPEC) — cache correctness: get_prepared_cache_for_g1/_for_g2 now require the requested vec to be a prefix of the cached vec before reuse, preventing cross-setup misuse of prepared points after init_cache is called for a different setup.

Test plan

• cargo nextest run --all-features passes (cross-mode acceptance, partial-ZK rejection, ArkGT zero/non-r-torsion rejection on both deser paths, oversized/u32::MAX/sigma-mismatch proof rejection, ZK roundtrip & verify, transparent roundtrip & verify)
• cargo clippy --all-targets --all-features -- -D warnings clean
• cargo fmt --check clean
• Existing soundness tests (tampered e2 / y_com / sigma1 / sigma2 / scalar product / vmv) still pass

Notes for Jolt

• DoryScheme::verify should call verify_transparent; DoryScheme::verify_zk should call verify_zk.
• Drop any externally-carried y_com; read it from the proof via DoryProof::y_com().
• The repr(transparent) wrapper change (chore: mark arkworks wrappers repr(transparent) #20) is in this checkout — Jolt remains exposed until it depends on a release containing it.