feat: evaluate at zeta wo FFTs

[ThomasPiellard]

@gbotrel this is a variation of PR #8 . On my laptop it seems to be more efficient by a large margin (I kept your parallelisation layout, but I am using Lagrange evaluation now, with precomputed values per size). Can you confirm the gain ?

---

Note

Medium Risk
Changes a core proof-generation step (evaluations at ζ) with a new numerical path; correctness is covered by tests against the old evaluator, but any mismatch would break proofs.

Overview
Replaces FFT-based zeta evaluation in the prover’s ComputeEvaluationsAtZeta phase with direct Lagrange interpolation at the challenge point ζ.

Adds LagrangesAtZeta to precompute all basis values L_i(ζ) once per domain size (with batch inversion), plus EvaluateLagrangeAtExt / ExtEvaluateLagrangeAtExt to evaluate base and extension trace polynomials via a weighted sum over Lagrange values. Rotated columns are handled by indexing the cached basis with a shift instead of multiplying ζ by ω^shift and running the old evaluator.

The prover now caches Lagrange weights per module size, builds one eval task per polynomial, and parallelizes per task (not per module). Size-1 (constant) columns still read the single coefficient directly. Tests assert the new path matches the previous EvaluateAtExt results.

^{Reviewed by Cursor Bugbot for commit be34a77. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gbotrel]

Compared current main (41d6eb3) against the GitHub merge refs for PR #8 (https://github.com/Consensys/loom/pull/8) and PR #14 (https://github.com/Consensys/loom/pull/14). I used merge refs because PR #8 was based
  on an older main.

  go test ./... -count=1 passed on all three revisions.

  Bench setup: bench/synth, poseidon2, GOMAXPROCS=32, Go 1.26.0, 32 CPU machine. Values are medians. Columns are prove wall / evaluations-at-zeta.

  ┌────────────┬──────────────────────────┬───────────────────┬──────────────────┬─────────────────┐
  │ shape      │                    trace │              main │            PR #8 │          PR #14 │
  ├────────────┼──────────────────────────┼───────────────────┼──────────────────┼─────────────────┤
  │ ultra-wide │  2^10 x 3072, 3.1M cells │  166.4ms / 99.5ms │   70.8ms / 2.2ms │  68.7ms / 1.7ms │
  │ wide-small │   2^12 x 768, 3.1M cells │  113.6ms / 58.9ms │   55.8ms / 1.8ms │  56.1ms / 1.5ms │
  │ balanced   │  2^16 x 192, 12.6M cells │ 440.7ms / 175.6ms │  280.4ms / 7.5ms │ 271.2ms / 8.3ms │
  │ wide-large │ 2^14 x 1536, 25.2M cells │ 675.9ms / 393.7ms │ 310.0ms / 13.1ms │ 307.9ms / 8.2ms │
  │ tall       │   2^20 x 24, 25.2M cells │   2.40s / 515.6ms │   1.97s / 78.9ms │  1.95s / 71.2ms │
  │ ultra-tall │    2^22 x 6, 25.2M cells │     7.50s / 1.17s │  6.79s / 409.2ms │ 6.78s / 294.8ms │
  └────────────┴──────────────────────────┴───────────────────┴──────────────────┴─────────────────┘

  Theory matches the numbers: PR #8 makes the existing FFT-based zeta evaluations parallel across columns; PR #14 changes the algorithm to direct Lagrange evaluation with cached basis values per domain size. PR #14
  usually wins the evaluations-at-zeta phase, especially on larger row counts, but total prove time is often nearly tied with PR #8 because compute-air-quotients and deep-quotient+fri-commit dominate after zeta is
  fixed.

  Bottom line: both PRs are big wins over main. PR #14 is the better zeta algorithm, but on bench/synth the end-to-end prove improvement over PR #8 is small: roughly tied on wide-small and ultra-tall, about 1-3%
  faster on the other measured shapes.