Ristretto Precomputed MSM Switcher

[Daeinar]

Follow-up to the review of #989 (#989 (comment)): the decision whether a mixed MSM should use the precomputed tables or a plain MSM moves from the caller into RistrettoPrecomputation.

What changes

• RistrettoPrecomputation stores the static points next to dalek's tables (dalek exposes no way to recover them). mixed_multi_scalar_mul runs Straus over the tables while static + DYNAMIC_POINT_WEIGHT * dynamic <= MAX_STRAUS_POINTS (3, 600) and otherwise one plain MSM over the chained static and dynamic inputs, with no concatenation.
• MixedMultiScalarMul::mixed_multi_scalar_mul doc: the implementation falls back itself; callers need not choose.
• test_precomputed_multiscalar_mul covers the fallback in both directions (static-heavy and dynamic-heavy) with the same length checks.
• New benches/mixed_msm.rs times the two dalek primitives over a grid of static sizes (powers of two and midpoints, 64..2048) and dynamic sizes (0, 32, 128, 512); it is how the constants were fitted and how they would be retuned on another machine.

Why a weighted rule

Straus over the tables is linear in the static count with a flat per-point cost, Pippenger's per-point cost falls with size, and the crossover sits far below what operation counts predict (the 7.7 KB per-point tables fall out of cache). Dynamic points shift the crossover: a dynamic point costs a per-call table and projective additions, about three static points' worth. Measured crossovers on an M2 Max with dense scalars: ~600 static points at D = 0, ~490 at D = 32, ~245 at D = 128; at D = 512 the plain MSM wins at every static size. Least-squares fit 589 - 2.7 D, rounded to the two constants. Near the crossover the two paths are within a few percent of each other, so a threshold misplaced by ~50 points costs under 1%.

A simpler design, deciding at precompute by static count alone and skipping the tables above it, regressed BP++ 64-bit x32 proving by 5.5%: its static-only MSMs still profit from the tables at 521 points while the verifier's mixed call does not.

Impact

BP++ (#989) keeps the decisions its hand-written fallback made (tables for all its provers and for verifiers up to 64-bit x16, plain MSM for the 64-bit x32 verifier) and will drop its own fallback arm once this lands. No other callers of the precomputation exist yet.

🤖 Generated with Claude Code

[Daeinar]

@jonas-lj 👆 Ready for your review. Thanks!