SHA: batch linear constraints without the nonlinear outer sumcheck

[wu-s-john]

Reduce the existing linear SHA relation to its assignment functional without constructing an R1CS outer zerocheck. This issue owns the linear PIOP route; the assignment-domain inner reduction and final BitZ opening remain required.

Current behavior and sources

The current Spartan entry point runs the outer sumcheck even for SHA rows with an empty A or B side. The current executable SHA relation, public-input contract, field admissibility and transcript specification (#2, #17, #19) remain the source of truth. The PoC linear protocol is an implementation reference; its runtime-prime/grinding policy must not silently replace this repository's profile.

Scope and normative protocol

Use a new, explicitly bound linear route while retaining generic R1CS support.

1. Bind the existing commitment, relation/map digest, public IO, field/profile, coordinate order and padding under a distinct protocol version. Any initial OOD claim introduced by feat: add initial OOD sampling to BitZ commitments #76 must remain before the PIOP challenges.
2. Sample the local-row and instance equality points after statement binding. Derive the batched linear residual functional over h = M(1 || f), preserving the repository's exact logical constant convention. Sample separate public-IO/constant batching challenges after their public descriptions are bound.
3. The prover performs the ordinary assignment-domain quadratic inner sumcheck for that functional. Every round message is absorbed before its challenge; the verifier derives the coefficients of the functional from public data. Do not serialize those coefficients as trusted prover data.
4. Return the terminal scaled witness-evaluation claim to the existing BitZ opening. There are no nonlinear outer-round messages in this route.

Preserve signed integer embedding into Fq and the existing no-alias bounds. Binary virtual-map evaluation is over F2; do not reinterpret prime-field values as F128.

Ordered verifier

Validate route/version, dimensions and field bounds; replay the statement and approved OOD prefix; derive row/instance/batching challenges; recompute the public functional; verify the expected inner round count/degrees and terminal matrix identity; verify the final BitZ/PCS opening against the bound root. A successful linear reduction alone is not acceptance. Handle zero batching/scale values algebraically, without division.

Done when

• Dense generic Spartan and the new route establish the same SHA relation on independent and chained cases.
• Mutated witness bits, public IO, constant slot, map digest, dimensions and terminal opening are rejected by the composed verifier.
• Golden tests pin the new absorb/squeeze order; the existing generic route retains its transcript.
• Tests cover zero/one challenges, non-power-of-two live counts and padding.
• Matched benchmarks report outer work removed, remaining inner/opening time, proof bytes and peak memory.

Dependencies and non-goals

Depends on #42 for reusable local geometry; coordinate with #76. Direct product-layout elimination of the inner check belongs to #78. Witness product removal belongs to #101. This does not change SHA semantics, security target, generic R1CS or the PCS.

Potential impact

Removes all nonlinear outer rounds and their product-table traffic for linear SHA. This is a structural saving, not a measured end-to-end speedup.