Bound proof-controlled codeword dimension in basefold verify

[aryaethn]

Summary

Hardens the BaseFold verifier against malformed proofs — the "verifier panic risks" item from the audit (#1).

basefold::verify derives k_code (the log2 codeword length) from the proof-supplied round_messages count — k_code = (round_messages.len() - log_batch_size) + log_inv_rate — and feeds it into 1 << k_code masks and FRI twiddle lookups at layers up to k_code - 1, without bounding it. The verifier's NTT only carries log_domain_size() layers of twiddles (it is built as AdditiveNttF128::standard(params.k_code()) for the committed instance). A proof claiming a larger codeword makes AdditiveNttF128::twiddle evaluate self.evals[log_domain_size - layer - 1] with layer >= log_domain_size — a usize underflow → out-of-bounds index → panic — reached before any Merkle check could reject the proof.

The fix rejects k_code > ntt.log_domain_size() up front with VerifyError::InvalidProofShape. Honest proofs have k_code == log_domain_size, so they are unaffected (the existing PCS roundtrip and end-to-end tests still pass).

What I checked

While auditing verify I confirmed the other proof-controlled index sites are already in-bounds by construction, so no extra checks are warranted there:

• compute_fri_arities returns positive arities summing to exactly log_dim, so arities[i + 1], the challenges[start..start + arity] slices, and cum_arity == log_dim (hence final_codeword[q.position >> cum_arity]) are all bounded.
• Query positions are masked to k_code bits, and per-query leaf lengths are length-checked before indexing.
• The query-count check (queries.len() == default_fri_queries(..)) and this dimension bound together keep the Vec::with_capacity(..) allocations bounded.

The Ligerito verifier already performs its own dimension/shape validation (e.g. the 1 << (cols + rate) query-count checks), so it is out of scope here.

Tests

• New verify_rejects_oversized_codeword_dim_without_panic: a proof whose round_messages count implies k_code beyond the NTT domain is rejected with InvalidProofShape instead of panicking.
• Full flock-core suite (257) + end-to-end roundtrip green.