chore: use fixed lookup tables in recursive IPA verifier

[suyash67]

The dominant cost of recursive IPA verifier (used in the root rollup circuit) is the $\mathcal{O}(N)$ MSM of the SRS elements (of Grumpkin curve) and the scalar vector $\vec{s}$. Currently, we use 4-bit ROM tables to store multiples of each SRS element and break down each scalar into 4-bit slices to perform scalar multiplication using Strauss' algorithm. Using ROM tables costs gates to initiate the ROM tables.

Instead of using ROM tables SRS points, we can use fixed lookup tables and perform lookups from them. There is no overhead of fixed lookup tables on gate count. This reduces the total gate count of the recursive IPA verifier massively, with a 2× reduction in dyadic circuit size of the root rollup circuit. Here's the summary:

Approach	Active gate rows	Lookup table rows	Dyadic circuit size
ROM batch_mul (baseline)	12,904,885	0	2^24
Plookup (8-bit lookup tables)	6,351,579	8,388,352	2^23

Minor note: we process the first element in SRS separately to avoid total lookup rows to jump over $2^{23}$.
With $2^{15}$ SRS points and 8-bit tables, lookup table rows = 32,768 × 256 = 2^23 exactly.
The 5 mandatory protocol overhead rows (NUM_DISABLED_ROWS_IN_SUMCHECK + NUM_ZERO_ROWS) push
the total to 2^23 + 5, forcing dyadic size to 2^24.

Handling one point via the standard operator* (ROM, 0 plookup table rows) reduces lookup
table rows to 32,767 × 256 = 8,388,352 < 2^23, giving total_num_gates = 8,388,357 < 2^23
and dyadic size = 2^23.