Introduce `deferred::Product<F>`, a wide 576-bit accumulator (8 limbs
+ 64-bit carry) that replaces the eager `Accumulator = Fp/Fq` in the
DeferredField implementations.
Products are accumulated via an internal `accumulate` method (no
public Add/AddAssign impls), ensuring carry overflow requires 2^64
operations. At reduction time, `partial_reduce` folds the carry and
top limb back into range using 2^512 ≡ R2 (mod p) and 2^448 ≡ B448
(mod p), producing a value < 2^449 < R*p that is safe for the
existing `montgomery_reduce`.
All existing DeferredField tests continue to pass unchanged—the lazy
accumulator is a drop-in replacement for the eager one.
Test the accumulation-based API for both Fp and Fq: single
mul/square round-trips, inner products at various lengths (0–10,000),
reduce-zero identity, square-vs-mul consistency, mixed mul+square
accumulation, and a regression test with adversarial limb values that
exercise the partial-reduction path.
All tests are written against the DeferredField trait API and will
continue to pass when the eager accumulator is swapped for a lazy one.
Add the `deferred` module with a `DeferredField` trait that enables
accumulating multiple unreduced products before performing a single
reduction. The trait uses an accumulation-based API: callers feed
factor pairs into an `Accumulator` via `mul_accumulate` /
`square_accumulate`, then call `reduce` once at the end.
For now, both Fp and Fq implement the trait with `Accumulator = Self`,
performing eager reduction on each accumulation. A later commit will
swap in a wide accumulator that defers reduction for real.
The module is feature-gated behind the `deferred` feature flag.
Pure refactor: the schoolbook multiplication and squaring bodies are
extracted into pub(crate) helper methods returning [u64; 8]. mul()
and square() now call through to these helpers followed by
montgomery_reduce(), preserving identical behaviour.
This separation makes the raw 512-bit product available for later
reuse (e.g. deferred reduction / inner-product accumulation) without
duplicating the arithmetic.
One, two! One, two! And through and through
The vorpal blade went snicker-snack!
He left it dead, and with its head
He went galumphing back.
Closeszcash/pasta_curves#42.
It was only present to enable an FFT implementation in `halo2_proofs`
that is generic over fields and groups, but we can replace it with an
equivalent trait in `halo2_proofs` that can have a blanket impl.
