perf(bb/msm): Jacobian (S, W) tree bucket reduction

[AztecBot]

Motivation

The previous bucket-reduction stage runs one workgroup per window with
batch-affine Montgomery-trick adds. At small c (e.g. c=8) each
window has only 2^(c-1)=128 buckets to drain and the workgroup is
mostly idle, while batch-affine forces each thread to gather S=8
points before any work happens.

This PR replaces that stage with a fully parallel Jacobian tree
reduction that treats all NW * 2^(c-1) weighted buckets as one block
of work and dispatches every merge in parallel. Each thread does a
small constant-time merge with no batched inversion and no
S-point gather, so GPU saturation no longer depends on per-window
fan-out.

Algorithm

For each window w, each tree node summarises a contiguous range of
buckets as a pair (S, W):

• S = Σ B[k] over the range,
• W = Σ (pos · B[k]) with pos = 1..h relative to the range start.

Merging two adjacent (S_L, W_L) and (S_R, W_R) of size h each into
one (S, W) of size 2h:

S    = S_L + S_R                       (1 group add)
hS_R = double S_R, log2(h) times       (l Jacobian doublings)
W    = W_L + hS_R + W_R                (2 group adds)

At the root, W is L_w = Σ k · B_w[k] for k = 1..N. Per window the
total is ≈ 5N/2 adds + ≈ N doublings — fewer rounds than the old
4-phase reduction and with full inter-window parallelism throughout.

Round 0 (AA -> J, leaf) and rounds 1..c-2 (JJ -> J) are
implemented as separate shaders, because the first level can use the
cheaper mmadd/madd formulas (Z = 1 both inputs) and skip Jacobian
loads entirely. As required by the design, neither shader checks the
x1 == x2 case — SRS bases are randomly-independent generators and
coordinate collisions in the reduction are vanishingly improbable.

Layout

• (S, W) pairs live in a 6-plane SoA buffer (S.X, S.Y, S.Z, W.X, W.Y, W.Z).
• Two ping-pong buffers cover all rounds; the final round writes to a
  dedicated jbrFinalBuf whose plane stride equals NUM_WINDOWS, so
  the per-window L_w gather is a contiguous 3-plane copy into
  redStaging.
• The host receives NW Jacobian points and Horner-combines them in
  Jacobian (one inversion at the very end). The C++ bridge consumer
  still sees per-window affine sums via windowSums (one inversion
  per window) for combineOnHost = false.

Files

• wgsl/cuzk/jbr_aa_to_jj.template.wgsl — round 0 (AA -> J leaf merge)
• wgsl/cuzk/jbr_jj_to_jj.template.wgsl — rounds 1..c-2 (JJ -> J merge)
• cuzk/shader_manager.ts — two new gen_jbr_* shader builders
• msm_v2.ts — replaces reduceInit + reduceLevel* dispatch with
  the AA->J + (c-2)×JJ->J schedule, rewires the L_w gather to the
  Jacobian buffer, and converts hostWindowCombine to take Jacobian
  inputs (the existing Horner already ran in Jacobian internally).
• jbr_reference.test.mjs — standalone bigint reference that verifies
  the (S, W) merge formula matches Σ k · B[k] for c = 2..10.
• dev/msm-webgpu/main.ts + scripts/run-browserstack.mjs — adds the
  ?autorun=msm-gpu-noble mode (and an --autorun flag on the
  driver) so a WebGPU-only correctness check against noble can run on
  BrowserStack without paying for the bb.js WASM bootstrap.

Test plan

• node src/msm_webgpu/jbr_reference.test.mjs passes for c=2..10
  (bigint reference matches a naive Σ k · B[k] MSM).
• Browser correctness via ?autorun=msm-gpu-noble&logn=14 on a
  BrowserStack macOS Sequoia / Chrome target (M2 Mini).
• Bench ?autorun=msm-cross-check once a slot frees up to measure
  c=8 and c=13 against the existing batch-affine reduction.

---

Created by claudebox · group: slackbot