PCS: compute the first sumcheck message while building the basis

[wu-s-john]

Supply Ligerito's already-supported precomputed first sumcheck message while constructing the packed basis, removing the immediate full reread of basis and witness. This is a target-wrapper integration, not a new protocol or dependency API.

Sources

BitZ reduced Ligerito prover and pinned Flock precomputed-message API is normative for the target contract. PoC fused basis/round-zero construction is implementation reference only; preserve target field, layout, transcript and security requirements unless this issue explicitly introduces a versioned protocol.

Current and proposed behavior

The target calls recursive_prover_with_basis, which computes the initial message itself. The pinned dependency already exposes recursive_prover_with_basis_precomputed_round0. During final basis construction, accumulate its exact (u0,u2) coefficients against the packed witness, then pass those coefficients through the reduced-prover boundary.

Required scope

• Match the pinned dependency's low-bit-first pair convention and coefficient encoding exactly. Use wide GF(2^128) products where available and reduce at safe kernel boundaries.
• Accumulate after all basis terms are known. If required OOD or extra claims add terms later, incorporate their coefficient contribution too, or deliberately use the ordinary fallback. Coordinate with PR feat: add initial OOD sampling to BitZ commitments #76 rather than freezing a pre-OOD basis contract.
• Preserve all transcript domains, first-message absorption, grinding placement, challenge draws, final verifier-only mirrored draws, and the final PCS handoff.
• Make absence of prepared coefficients explicit; never use zeros as a sentinel. Borrow/move ownership changes are separate PCS: borrow reusable witnesses and lazily cache alternate layouts #134 work.

Impact is one removed read of witness plus basis: approximately 32N bytes for N packed 16-byte elements. It does not eliminate basis construction, arithmetic, commitment work or an interactive round. Measure the complete preparation-plus-opening boundary, not only the shortened Ligerito call.

Done when

• Prepared coefficients equal the dependency's unfused calculation for random, sparse, all-zero, extra-claim and OOD-augmented bases.
• Prepared/unprepared proofs and transcript fingerprints match at every supported size/profile; malformed final proofs retain rejection behavior.
• Minimum-size/tail handling and fallback are tested.
• Phase timings and bytes read show the pass removal without moving equivalent work into an unmeasured preparation phase.

Dependencies and coordination

No prerequisite optimization port. Coordinate with #76.