refactor: delete the batched proof format, per-table only

[MauroToscano]

Draft. Removes the batched multi-Merkle-tree proof format from this lane, leaving the
per-table prover as the only format on this branch, end to end.

This is one of two drafts held side by side rather than a retirement. The batched format
stays open as #951 and is preserved in full at
archive/batched-format-pre-deletion @ 59fc77d. "Where a new proof format attaches"
below is the map of the seams it used, written for whoever adds the next one.

+610 / −15,776 over 35 files, six signed commits, one area each.

area	+/−	what goes
crypto/stark	+47 / −7,477	batched/{proof,prover,round4,verifier}.rs, fri/batched.rs, and the two suites whose subject they are (batched_mmcs_soundness_tests.rs, batched_prover_tests.rs)
crypto/math-cuda	+1 / −730	src/mmcs.rs, its five backend handles, the five MMCS kernels in kernels/keccak.cu, and tests/mmcs_tree_parity.rs
prover/src/lfm	+513 / −7,208	batched_epoch.rs, batched_epoch_verify.rs, group_leaf_tests.rs, aggregator_tests.rs, the batched entry points in proof.rs, and the batched tests across five files
prover/src/continuation.rs	+49 / −361	EpochProofFormat / EpochProofBody collapse to a plain MultiProof field

Two files stay alive on purpose and die in the follow-up: batched/shape.rs and
fri/mmcs.rs. Production code outside stark still reads them —
prover/src/lfm/registry.rs takes a &RoundShape in pinned_prep_widths, and
prover/src/lfm/commit.rs's PrepRoundBuilder is a StreamingMmcsBuilder. Both go with
the preprocessed round root in the registry commit, which is sequenced after the pin
regeneration.

The wire format moves

EpochProof.proof is a MultiProof where it was an EpochProofBody enum, so every
archived bundle carries a discriminant a reader built after this change does not expect.
RECURSION_INPUT_VERSION goes 2 → 3 with it.

That bump is the point, not a cache-busting trick. The version field is the DESIGNED
guard for an incompatible encoding — its own doc records v1 → v2 as "32-bit offsets and
are incompatible" — and this branch moved the encoding without it at first. The visible
cost was 17 failures at proof_fixture.rs:231, because load_or_generate returns the
cached blob whenever prefix_is_readable passes and that checks only magic and version.
The invisible cost was the real one: recursion_archive_bytes exists so a wrong-format
blob halts legibly "instead of surfacing whatever bytecheck makes of old-format bytes",
and the guest calls it before its unsafe in-place read. At version 2 a stale blob passed
that check and reached rkyv::access.

cache_format_key is deliberately NOT changed, though folding the format in would also
have made the 17 green. Its documented job is the axes that move the bytes WITHOUT moving
the version — the statement domain tag and the commitment hash, both pin-level. A
version-moving change is already separated by the prefix check, so keying on it twice
would state one fact on two axes that can drift apart. Keying the cache would have turned
the tests green while leaving the legibility hole exactly where it was.

The global leg moves rather than dying

aggregator_tests.rs is typed end to end on BatchedMultiProof, but its GLOBAL leg is
not: the cross-epoch global memory proof is per-table under either format. RealGlobal,
real_global, GlobalTableArenas, global_verifier_program, global_arena_words and
the_global_verifier_leg_runs_and_rejects_tampers move verbatim into
per_table_aggregator_tests.rs, non-ignored, with one substitution: the fixture bundle
comes from prove_continuation instead of prove_continuation_batched. Identical
signatures, and real_global already took a plain ContinuationProof.

Why the rebase kept that file deleted, and what was checked first

The RPX pin edits aggregator_tests.rs, so the rebase hit a modify/delete. Resolving it
to KEEP DELETED is exactly the kind of resolution that looks like dropping someone else's
fix, so it was verified rather than assumed. The pin's entire diff to that file is one
pattern applied seven times — build_artifacts(...) →
build_artifacts_with_hasher(..., BLOCK_HASHER) at :1682, :1880, :1928, :2198, :2423,
:2458, :2588, plus the import at :39. None of the seven lands inside the six ranges
extracted into per_table_aggregator_tests.rs; all are in fixture_leg, fixture_wraps,
fixture_aggregate, the_aggregate_leg_census_matches_the_closed_form and
the_real_block_aggregates_end_to_end, every one deleted. And the extracted file needs
none of them: it contains no build_artifacts call at all, builds at
WrapHash::production() and names BLOCK_HASHER at both execute sites, so it already
satisfies the classification rule by executing rather than proving. Keeping the deletion
drops no pin fix.

The other rebase conflicts resolve in the PIN's favour wherever the enclosing item
survives. In particular wrap_tests.rs takes the pin's import block — it drops
TestPermutation and widens build_artifacts to {build_artifacts, build_artifacts_with_hasher}, both serving the_census_agrees_with_the_traces_the_prover_builds,
which survives — and keeps the pin's module-doc rewrite explaining why that test reads its
tenant from artifacts.hasher: the socket chip's width is tenant-dependent, so a
defaulted HasherKind is an out-of-bounds index rather than a disagreement.

Two tests edited rather than deleted

Their batched half was an arm of a claim that is not batched.

blake3_chip_tests::chunked_blake3_proves_and_verifies loses its batched arm only; the
per-table prove/verify and the host-chain digest equality stay.

algebraic_transcript::phase_a_absorbs_derive_the_hosts_shared_pair loses the shape
histogram, both sides of it, and survives the format it was written beside. What the gate
is actually for is format-independent: that a preprocessed root reaching the transcript as
program TEXT (append_const_bytes) and as proof-carried cells (RootCells::constant +
absorb_misaligned) derives the same challenge, i.e. that bytes_to_cell and
commitment_to_digest agree. That is Phase A's property under either format, it is
invisible under a byte hash, and it is load-bearing precisely because the block path is
now algebraic. Deleting it whole would have removed a live gate to tidy a format.

One intended coverage loss

algebraic_commit::the_mixed_group_leaf_equals_the_hosts_group_hash is deleted. Its
subject is a leaf over SEVERAL concatenated matrices, which only the mixed-height MMCS
constructs, so the property has no per-table meaning. The one-matrix case it degenerates
to stays gated by the_emitted_leaf_and_parent_equal_the_hosts_backend in the same file.
group_leaf_tests.rs covered the same construction and goes with it.

Bycatch, not churn

Two doc blocks were misattached before this branch, each by a missing blank line between a
doc comment and its item, and each is returned to its owner by deleting the batched item
that had absorbed it: real_epoch_with in epoch_tests.rs (absorbed by
the_real_block_base_epoch_ab) and the_real_blocks_page_census in wrap_tests.rs
(absorbed by the batched block driver).

Where a new proof format attaches

The batched format is not being erased — it stays open as #951 and as
archive/batched-format-pre-deletion @ 59fc77d, the last tip carrying all fourteen
batched and mixed-height files. This section is the map that branch is a reference
implementation of: every seam a second format used, and what this PR leaves standing
there. A third format's cost is dominated by finding these, not by editing them.

seam	what the batched format put there	after this PR
epoch container + dispatch	EpochProofFormat (the choice), EpochProofBody (the payload), EpochProofView::batched_proof, BatchedEpochProofRef	collapsed — EpochProof.proof is a plain MultiProof
prove entry	prove_continuation_batched → prove_continuation_with_format → prove_epoch(format) and its match	collapsed — prove_continuation only
verify entry	verify_epoch's second arm, replaying and verifying the carved proof	collapsed — one straight-line arm
LFM prove/verify	lfm_prove_batched, verify_against_batched, BatchedLfmProof — deliberately siblings of lfm_prove/verify_against rather than an Option, because the wire type differed	deleted; the per-table pair is unchanged
host prover/verifier	stark::batched::{prover,verifier} beside stark::prover::multi_prove / stark::verifier::multi_verify	deleted
low-degree test + commitment	fri/batched.rs (height combination, batched commit phase, shared challenge derivation) and fri/mmcs.rs (mixed-height MMCS) beside fri::commit_phase_from_evaluations / fri::query_phase	fri/batched.rs deleted; fri/mmcs.rs still standing
recursion emitters	lfm/batched_epoch.rs (challenge spine) and lfm/batched_epoch_verify.rs (walk, query mix, FRI leg) beside lfm/epoch.rs, lfm/epoch_verify.rs, lfm/sub_proof.rs	deleted
shape description	stark::batched::shape — RoundShape, EpochShape, PinnedPrep, CarvedMain	still standing
preprocessed round root	lfm/commit.rs::PrepRoundBuilder and registry.rs's prep_root / pinned_prep_widths	still standing
device	math_cuda::mmcs and its five keccak kernels beside merkle.rs	deleted
wire version	—	RECURSION_INPUT_VERSION, which MUST move whenever the archived encoding changes

Two things are worth knowing before reading that table as a to-do list.

The container enum is probably the wrong seam for a low-degree-test swap. The batched
format needed a container variant because it changed the SHAPE of an epoch proof: one
mixed-height-MMCS proof for the whole epoch instead of one per table. A format that
replaces the proximity test while keeping one proof per table changes what lives INSIDE a
StarkProof — the commit phase, the query phase, the FRI payload and its emitter legs —
and needs no container variant at all. That work lands in the fri seam and the emitter
seam, both of which this PR leaves structurally intact on the per-table side.

The wire version is the guard, and it is easy to forget. Any format change that moves
the archived encoding must bump RECURSION_INPUT_VERSION. This PR is itself the worked
example: the collapse moved the encoding, the bump was initially missed, and the failure
surfaced far away as a stale fixture blob rather than as a format error.

Evidence

Gated at this head:

cargo check --workspace --all-targets                 exit 0
make lint                                             exit 0   (all five feature passes,
                                                                including cuda)
cargo test --release -p stark
  285 passed; 0 failed; 3 ignored   (lib binary + three integration binaries)
cargo test --release -p lambda-vm-prover --lib
  1095 passed; 8 failed; 43 ignored; 0 measured; 0 filtered out; finished in 2108.80s
machine_tests::registry_drift_*                       6/6 green

An earlier gate of the same six commits on the pre-pin tip read 1102 / 1 / 43; its single
failure was epoch_tests::the_closure_rejects_a_moved_index_or_output, which is also in
the list below. The rebase onto the RPX pin is what brings the other seven.

All 8 failures are the pin's, none are this branch's. #967 lands with ten known-red
tests; this branch deletes two of them because they are batched
(epoch_tests::the_assembled_carved_batched_epoch_verifier_runs and
epoch_tests::the_batched_query_census_matches_the_closed_form), leaving the other eight
untouched: epoch_tests::the_closure_rejects_a_moved_index_or_output,
fri_tests::the_emitted_permutation_count_meets_the_pinned_prediction,
fri_tests::the_fri_join_adds_no_second_point_derivation,
machine_tests::register_derivation_cost,
machine_tests::the_register_derivation_matches_production,
machine_tests::the_register_derivation_proves_and_verifies,
machine_tests::transcript_replay_cell_counts, and
per_table_census_tests::the_blake3_tenant_socket_matches_the_record. See #967 for why
each is red.

The arithmetic closes from both ends. #967's gate reads 1119 / 10 / 47 = 1176. This branch
removes 30 tests, of which 2 were failing, 4 were ignored and 24 were passing, giving
1095 / 8 / 43 = 1146 — and 1146 is what cargo test -- --list reports at this head
independently.

One counting note, because two different numbers in this area are easy to conflate. A
#[test] ATTRIBUTE count is not a count of what RUNS: modules behind debug-checks,
disk-spill and cuda are compiled out of a default build. crypto/stark/src carries 307
attributes at this head and the binary runs 285, and grepping #[ignore] over
prover/src over-counts the ignored total by one for the same reason. Every count quoted
above is from a gate run rather than from a grep.