starknet_os: add the digests of a single transaction's processed proof

[einat-starkware]

Part 2 of the single-proof verification stack: one transaction's proof, verified against the OS output. Combining proof facts across transactions is out of scope and deferred to a later phase — the code here treats the problem as a single transaction with a single proof facts array.

The proving side processes proofs into a proof of the multiverifier circuit, whose output packs the circuit hash and output digest of each of the proofs verified in its two verifier slots. This PR adds the Rust computation of:

• compute_processed_proof_output_digest: the processed proof's output digest over two verified proofs' facts. The function is general (two proof-facts arguments); a single transaction's proof fills both slots, so callers pass the same proof facts twice.
• compute_verification_digest: the digest the circuit verifier outputs when run on the processed proof — blake2s(multiverifier circuit hash ‖ the processed proof's output digest).
• The leaf verifier and multiverifier circuit hash constants (pinned to the vendored registry in apollo_starknet_os_program,starknet_os: cite the circuit hashes' source and add todos #15086).

Golden values are proving-side confirmed: stwo_run_and_prove_recursive_tree (proving commit b75d21f9) over the golden leaf reproduces the processed proof's output digest exactly (see #15088's fixture).

Per review preference, the code carries no comments beyond short doc lines.

Stack: #15090 ← this PR ← #15092 ← #15064 ← #15086 ← #15088 ← #15095.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

[cursor]

PR Summary

Medium Risk
New cryptographic digest logic must match the prover exactly; wrong constants or hashing would break verification, though behavior is pinned by proving-side golden tests and circuit hashes are explicitly temporary.

Overview
Extends proof_fact_fold with the processed-proof and verification digest steps for single-transaction proof checking, matching the proving side’s recursive multiverifier tree.

Adds LEAF_VERIFIER_CIRCUIT_HASH and MULTIVERIFIER_CIRCUIT_HASH (currently canonical_small placeholders; TODO to swap for production registry values). combine_leaf_digests hashes two leaf outputs by Blake2s over (leaf circuit hash ‖ leaf digest) for each side and concatenating. compute_verification_digest is Blake2s over multiverifier circuit hash ‖ processed proof output digest.

Tests are refactored around shared golden proof facts and assert leaf, processed-proof (same golden leaf in both multiverifier slots), and verification digests against proving-side goldens.

^{Reviewed by Cursor Bugbot for commit 161b81e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[Yoni-Starkware]

@Yoni-Starkware reviewed 2 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on einat-starkware).

[gkaempfer]

Security scan complete — no issues detected.

---

Generated by Claude Code