refactor(stm): cache the circuit test fixtures on disk - #3481

Content

This PR extends the content-keyed FileMutex cache introduced by #3433 to both circuit test trees, which had none. Under the nextest process-per-test model an in-process cache amortizes nothing, so the SRS, the derived recursive verifying key, the certificate circuit keys and the deterministic 3000-signer fixture are now computed once per fingerprint and shared across test processes and runs.

Measured locally: circuits::halo2_ivc slow tier 435 s → 381 s, circuits::halo2 slow tier 50 s → 44 s (−12 % each, ±8 s run to run). Numbers per ticket item are in #3462.

Changes

• Shared SRS (halo2_ivc/tests/common/generators/setup.rs): build_shared_recursive_context reads the degree-19 SRS from the same "unsafe-srs" entry IvcSnarkProverSetup::build_for_test writes, both deriving from the same seed. A compile-time assertion ties ASSET_SEED to UNSAFE_SRS_SEED, so a change to either cannot silently alter the committed assets.
• Recursive verifying key: cached as a single blob under a fingerprint that folds in the freshly derived certificate verifying key, the committed production recursive key, both circuit degrees and the SRS seed. The certificate key is derived on every call (~93 ms) because its bytes are part of the cache address.
• Certificate circuit keys (halo2/tests/golden/helpers.rs): the process-local LazyLock map is replaced by the on-disk KeyProvider, behind the cache lock so parallel processes racing a cold miss derive the pair once. The SRS asset filename now carries the seed that produced it, so a seed change cannot pair an old SRS with keys fingerprinted for a new one.
• Signer fixture: the generator-derived values are cached as CBOR; everything else in AssetGenerationSetup is a pure function of them and is recomputed on both paths, so the two cannot disagree. Validated on load — vector lengths, plus the genesis signature verified against the message derived from the cached tree, which transitively covers tampering with the tree, the key or the signature.
• Cache contract: entries are rebuilt on an absent, unreadable, undecodable, non-canonical or validator-rejected file, and never surface as an error. It makes no wider claim: canonical encoding shows the bytes are self-consistent, not who wrote them.
• Tests: 11 new, all fast and hermetic — cold miss, warm hit, truncation, trailing bytes, validator rejection, the real signer-fixture validator (fresh / wrong lengths / changed tree / changed key or signature), and input-by-input coverage of all three production cache fingerprints.

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested
• Documentation
  • No new TODOs introduced

Issue(s)

Closes #3462