Integrate lookups with simple benches

[amit0365]

Closes #107 — Phase 4 decomposed lookups + full protocol wiring.

Summary

Decomposed lookups (piop/src/lookup/):

• logup.rs: build_reconstruction_group (single γ-batched degree-2 group for L reconstruction identities), extract_decomposed for chunk extraction, finalize_verifier updated with subtable-aware identity checks for decomposed groups
• utils.rs: subtable generators (generate_bitpoly_subtable/generate_word_subtable), decomp bases (bitpoly_decomp_base/word_decomp_base), decompose_bitpoly_column/decompose_word_column - mostly copied from @albert-garreta agentic branch.
• structs.rs: DecompInfo (subtable + decomp_bases + chunks), LookupGroupPcsData with optional ChunkPcsData, LookupEvalsFlat

Protocol wiring (protocol/src/):

• lib.rs: Proof struct extended with lookup_chunk_commitments, lookup_chunk_evals, lookup_chunk_lifted_evals
• prover.rs: prepare_lookup_groups branches on chunk_width — non-decomposed commits m/u against full table, decomposed decomposes into L*K virtual columns, commits chunks + m/u against subtable, appends reconstruction group; pcs_open! macro for consolidated PCS openings
• verifier.rs: finalize_lookup_groups method handles both paths — inline reconstruction check for decomposed groups, md_group_idx advances by 3 (2 LogUp + 1 reconstruction); pcs_verify! macro for PCS batch verification

Test UAIRs (test-uair/src/lib.rs):

• DecomposedWordUair (Word(8), chunk_width=4, K=2), DecomposedBitPolyUair (BitPoly(8), chunk_width=4, K=2)
• Word8LookupUair, RangeCheck8Uair — comparison pair for lookup vs constraint benchmarking
• impl_int_copy_trace!, impl_bitpoly_int_trace!, impl_sum_pair_trace! macros for trace generation boilerplate

Benchmarks (protocol/benches/e2e.rs):

• SimpleLookupUair in main E2E group (nvars 8/10/12)
• lookup_vs_constraint comparison group: Word8LookupUair (Word(8) lookup) vs RangeCheck8Uair (binary decomposition) side-by-side
• BenchZincTypes extended with LookupZt/LookupLc, CombR widened to 448 bits for LC bit budget with Int<4> lookup evals

Optimizations

• Decomposed batching: L columns × K chunks → still only 2 LogUp groups + 1 reconstruction group check for decomposed chunks
• Chunks committed via PCS — reduces proof size instead of sending in the clear

Benchmark: 8-bit range check — Lookup vs Constraint

num_vars	Lookup (Word(8))	Constraint (BinaryPoly)	Ratio
8	3.80 ms	1.81 ms	2.1×
10	33.3 ms	9.78 ms	3.4×
12	83.7 ms	31.3 ms	2.7×

Why lookups are slower here:

1. Extra PCS commitments — LogUp requires committing auxiliary columns (m, u) per lookup group. PCS commits dominate proving cost in Zinc+.
2. Widened CombR — to fit Int<4> (256-bit) lookup evals in the PCS linear-combination bit budget, CombR was widened from 6 limbs (384 bits) to 7 limbs (448 bits). This slows every PCS operation across the entire proof, not just the lookup portion.

To improve lookup performance, we should consider using GKR verison of LogUp

Test plan

• 23 utils unit tests: subtable/decomp-base values, decomposition roundtrips (BitPoly K=2/3, Word K=2/4), invalid witness rejection
• 7 E2E lookup roundtrips: Simple, MultiCol, MultiGroup, BitPoly, DecomposedWord, DecomposedBitPoly, Word8
• 3 non-decomposed negative tests: tamper aux evals, tamper lifted evals, tamper commitment
• 4 decomposed negative tests: tamper chunk evals (Word + BitPoly), tamper chunk commitment (Word + BitPoly)