fix(proofs): bound unknown-order verification

[piotr-roslaniec]

Summary

• enforce one shared 2,048..65,536-bit policy before expensive work in every exported unknown-order proof verifier
• keep the tight legacy Bob bound in one core path and widen it only for the explicit historical opt-in
• reuse ModProof constant-time p, q, and N contexts and fixed exponents across all 80 iterations
• strengthen the ModVerify ceiling regression with an odd 65,537-bit input and preserve CT/non-CT proof-byte equivalence

Local evidence

• go test -shuffle=on -count=1 ./common ./crypto/dlnproof ./crypto/mta ./crypto/paillier
• go test -race -shuffle=on -count=1 ./common ./crypto/dlnproof ./crypto/mta ./crypto/paillier
• go build ./... && go vet ./...
• testdata/legacy_transcript/verify.sh
• deterministic ModProof benchmark median: 1.638s / 2.58MB / 23,616 allocs before; 1.647s / 1.83MB / 17,349 allocs after. Runtime is unchanged within noise; allocations fall about 27%.

Review

Independent static review found no correctness or security blockers.

[piotr-roslaniec]

Final integration evidence at 69d026ed109d0f54b45451e63bb61f8b11d29003:

• Independent static review found no correctness or security blockers.
• Changed packages passed shuffled tests and race tests.
• The odd 65,537-bit ModVerify ceiling regression passed 20 consecutive runs.
• Full build, vet, and bidirectional historical transcript oracle passed.
• Deterministic ModProof benchmark retained equivalent runtime within noise while reducing median allocation from 2.58 MB / 23,616 allocs to 1.83 MB / 17,349 allocs.
• Go-fmt run 36689263264 and full Go Test run 36689263547 passed.