fix: use F+E mixed addition instead of F*E(1) for bus_id promotion

Author: diegokingston

prover/src/lib.rs

@@ -438,10 +438,9 @@ pub(crate) fn compute_commit_bus_offset(
     }
 
     let alpha_sq = alpha * alpha;
-    let bus_id = FieldElement::<F>::from(BusId::Commit as u64);
-    // Negate once: fingerprint = z - lc = -(lc - z) but we compute z - lc directly
-    // by precomputing z_minus_bus = z - bus_id (F×E mixed subtraction)
-    let z_minus_bus = z - bus_id * FieldElement::<E>::one();
+    let neg_bus_id = -FieldElement::<F>::from(BusId::Commit as u64);
+    // z - bus_id = z + (-bus_id), using F + E mixed addition
+    let z_minus_bus = neg_bus_id + z;
     let mut fingerprints: Vec<FieldElement<E>> = public_output
         .iter()
         .enumerate()