feat: add initial OOD sampling to BitZ commitments

[shreyas-londhe]

Add an initial out-of-domain (OOD) evaluation of the committed packed witness before the Spartan and BitZ challenges. Batch that claim into the existing Ligerito opening.

• Derive OOD grinding from the PCS profile; UDR omits the OOD round.
• Extend CommitScheme with transcript-aware commitment and verification methods. Retain the same OOD claim for dense and succinct openings.
• Return CommittedWitness from circuit commitment and consume it during proving, preserving the transcript that sampled the OOD point. Verification receives the claim before replaying circuit proof challenges.

This changes the BitZ and circuit proof transcripts and the circuit commitment API. Raw Pcs::commit remains available without OOD; callers using the OOD path must continue the commitment transcript through opening.

Regression tests cover altered, missing, and truncated OOD values, invalid grinding nonces, and dense/succinct round trips. Focused PCS, BitZ, and circuit tests, Clippy, formatting, and Rustdoc checks passed locally; the all-shapes test reaching m28 was not completed. Byte-for-byte transcript equivalence with BitZ-PoC remains unverified.