Fix : Unbound LogUp Transcript Challenges Let the Prover Choose Lookup Randomness [LA-G]

[ocdbytes]

Summary

• Backport of the soundness fix for unbound LogUp transcript challenges to the v1 branch.
• The verifier samples Fiat-Shamir challenges for LogUp lookups but discards them (let _logup_challenges), never verifying that the committed
  w2 polynomial contains them. A malicious prover could substitute arbitrary challenge values in w2 without detection, breaking the LogUp
  argument's soundness.
• Adds challenge binding that mirrors the existing public input binding pattern: prover sends challenge_eval as a transcript-bound
  prover_message, verifier independently recomputes from sampled challenges and checks equality, and a SparseCovector weight is included in the
  WHIR verification for w2.

Changes

Core fix (prover + verifier transcript consistency):

• provekit/prover/src/whir_r1cs.rs — Compute challenge_eval = Σ xⁱ · w2[offset_i] and send as prover_message (transcript-bound). Add
  SparseCovector challenge weight to w2's WHIR prove call.
• provekit/verifier/src/whir_r1cs.rs — Retain sampled challenges (was discarded via let _logup_challenges). Read challenge_eval from
  transcript, verify against independently computed expectation via verify_challenge_binding(). Add matching challenge weight to w2 WHIR verify
  call.

Supporting infrastructure:

• provekit/common/src/prefix_covector.rs — Add SparseCovector (implements LinearForm for non-contiguous positions),
  make_challenge_weight(), and compute_challenge_eval(). Includes 6 unit tests.
• provekit/common/src/whir_r1cs.rs — Add challenge_offsets: Vec<usize> field to WhirR1CSScheme so the verifier knows where challenges
  sit in w2.
• provekit/common/src/witness/witness_builder.rs — split_and_prepare_layers now returns Vec<usize> challenge offsets (was usize
  count) extracted from remapped Challenge builders.
• provekit/r1cs-compiler/src/whir_r1cs.rs — WhirR1CSSchemeBuilder::new_for_r1cs accepts challenge_offsets. Added debug_assert_eq!
  enforcing num_challenges == challenge_offsets.len().
• provekit/r1cs-compiler/src/noir_proof_scheme.rs — Noir path destructures offsets from split_and_prepare_layers; Mavros path generates
  (0..challenges_size).collect().