outer sumcheck: add generic small-value univariate skipping

[wu-s-john]

Add a selectable, generic small-value univariate prefix to the outer zerocheck, replacing k ordinary rounds for 1≤k≤min(4,n). This issue owns the new prefix proof, its verifier, exact-integer arithmetic integration, and the resulting row functional handed to matrix binding.

Current behavior and source of truth

The target always starts an ordinary cubic outer sumcheck. Its relation, field profile, layout, statement binding, and final F2Z acceptance contracts in #19/#2 are authoritative. The PoC prefix and PoC reconstruction are references only. Specify and review the target protocol extension before implementing it; do not copy PoC domain tags or field encodings.

Relation and protocol

Public data are the existing statement, field, padded row/column domains, prefix width k and protocol version; the assignment remains private. Let m=2^k. The low k row bits index D={0,…,m−1}; remaining bits retain target order. Eligibility requires A(s,t)B(s,t)=C(s,t) at each Boolean row, not merely a zero weighted sum. Reject invalid dimensions and fields in which required interpolation nodes collide.

1. Bind the statement and prefix choice/version before deriving its challenges, preserving any commitment/OOD session established by the target.
2. Sample the n−k tail equality coordinates. Interpolate each m-row block with Lagrange weights. Its equality-weighted residual Q(Y) has degree ≤2m−2 and vanishes on D; equivalently Q=Z_D·H with degree(H)≤m−2.
3. Absorb a canonical m−1-element prefix message: m−2 fixed exterior evaluations of Q and its leading coefficient. Only then sample z. Reconstruct Q(z) using the known roots, including z∈D without challenge-dependent division.
4. Fold each A/B/C block at z and run n−k ordinary cubic rounds from claim Q(z), preserving their absorb-then-squeeze order. Absorb terminal A/B/C evaluations before sampling matrix batching rho.
5. Bind matrices with the Lagrange-prefix × Boolean-tail row functional, run the existing inner reduction, and discharge its terminal assignment claim through the existing F2Z/PCS path. The prefix does not authenticate that claim itself.

Ordered verifier

1. Validate field/profile, k, shapes and canonical proof encodings, then replay statement/prefix binding and tail challenge sampling.
2. Check the exact prefix message length, absorb it, derive z and reconstruct Q(z).
3. Verify exactly n−k cubic rounds; reject any round-sum or final residual-identity mismatch. Handle the empty-tail case k=n.
4. Absorb terminal evaluations, derive rho, compute the same prefix row functional and verify inner reduction.
5. Return/verify the resulting F2Z claim according to the target API; final acceptance requires the downstream opening verification.

Scope and validation

• Derive and review the prefix-plus-tail soundness bound, including the degree-≤2m−2 prefix test, remaining cubic rounds, zero equality coordinates and empty tails. Integrate every new error contribution into the target's full security budget and profile gate; reject unsupported parameter sets.
• Integrate exact signed/narrow operands from outer sumcheck: retain exact native rows through the first fold #82; prepare public interpolation constants once and use checked public width bounds. Keep the ordinary path available.
• Cover k=1..4, k=n, singleton tails, zero/one tail coordinates, vanishing equality factors, padding and maximal signed/native operands against direct polynomial evaluation.
• Reject wrong k/message count, field-node collisions, altered prefix/tail/evaluation/opening messages, wrong statement/layout and unsatisfied rows. Add version-specific prover/verifier transcript goldens; equivalence to the old ordinary transcript is neither expected nor claimed.
• Measure prefix, tail, binding, proof size and peak memory separately under matched security, field, compiler and threads; do not weaken security parameters to obtain a timing result.

The field tail has N/2^k rows. Prefix field payload is 2^k−1 versus 4k ordinary coefficients: savings 3/5/5/1 elements for k=1/2/3/4 and k−1 challenge boundaries, excluding framing. Prefix work remains, so this is not a 2^k overall speedup. Out of scope: inner univariate skipping, unrelated PCS changes, or any claim that a zero aggregate implies rowwise zero.

Depends: #82. Related: #19, #41; coordinate session binding with open PR #76 if it lands.

Difficulty: hard; urgency: high. This combines a new transcript reduction with width-sensitive arithmetic and a changed matrix row functional; no immediate blocker has been established.