starknet_transaction_prover,starknet_os,workspace: run the circuit verifier as a bootloader task

[einat-starkware]

Part 7 of the privacy proof-fact fold stack, on top of #15086. Implements the decision that the verifier is called from the simple bootloader, and closes the comparison loop on the sequencer side.

starknet_transaction_prover::verifier_task:

• run_circuit_verifier_task builds a SimpleBootloaderInput with the Cairo1 circuit verifier as its single task (Blake program hash function, single_page: true), runs it in-process via cairo-program-runner-lib, and parses the bootloader output page [1, 10, verifier_program_hash, digest word 0..7]. An invalid proof — or any verifier/proof configuration mismatch, which the verifier makes indistinguishable by design — fails the run, so there is never an output to misinterpret.
• verify_circuit_verifier_task_output performs the comparison the whole project exists for: the verifier program hash against a pinned value (the task's only identity), and the verifier's digest against blake2s(multiverifier circuit hash ‖ root output digest) recomputed from the packed proof_facts_root_output_low/high the OS emits (apollo_starknet_os_program,starknet_os,blockifier: emit the proof-fact fold in the OS output #15064), via a new unpack_output_digest mirror in starknet_os::proof_fact_fold.

Dependency: the workspace's dead cairo-program-runner-lib = "1.1.0" entry (a crates.io requirement nothing consumed) is rewritten to the proving-utils git tag already pinned in the lock (v0.14.3-rust-bump), unifying with the existing 1.2.2 — the Cargo.lock delta is one line. The lib pulls no stwo/nightly crates, so the module is unconditional (not behind stwo_proving).

Tests run the whole chain on real data (57s total in debug): the four_leaves golden root proof is verified by the fixture verifier executable under the vendored simple bootloader; the resulting digest matches the digest expected from the OS-side fold of the same four transactions' proof facts; wrong pinned hash and wrong emitted digest are rejected; a corrupted proof felt fails the run. Fixtures (~1.3MB gzipped) carry documented provenance: the bootloader from the pinned proving-utils tag, the verifier executable built from proving-dev b75d21f9 with scarb 2.19.4 (dev profile — production artifact ownership and the proving-profile/qm31_opcode question remain open), and the root proof from the proving-dev goldens.

Verified: 2/2 verifier-task tests, 24/24 fold tests (including the new unpack_output_digest roundtrip), 17/17 workspace tests, clippy and rustfmt clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

[reviewable-StarkWare]

This change is 

[cursor]

PR Summary

Medium Risk
Introduces in-process Cairo verifier execution and digest binding to OS proof-fact fold output; mistakes could break privacy proof acceptance, though behavior is covered by golden integration tests.

Overview
Adds starknet_transaction_prover::verifier_task so the privacy Cairo1 circuit verifier runs as a simple-bootloader task via cairo-program-runner-lib (new workspace dependency; lockfile also pins cairo-program-runner-lib 1.3.1 for this crate alongside existing proving git crates). run_circuit_verifier_task executes the verifier on a root recursive proof and parses bootloader output (pinned program hash + fold digest); verify_circuit_verifier_task_output checks that digest against blake2s(multiverifier circuit hash ‖ root output digest) recomputed from the OS’s packed proof_facts_root_output_low/high.

starknet_os::proof_fact_fold gains unpack_output_digest, the inverse of pack_output_digest, with roundtrip/range tests. Integration tests run the full four_leaves golden path (bootloader + verifier fixtures) and reject bad hashes, swapped digests, and corrupted proofs.

^{Reviewed by Cursor Bugbot for commit fcf4042. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Artifacts upload workflows:

• Started at 2026-09-02T10:27:05Z
• Started at 2026-09-02T11:47:17Z
• Started at 2026-09-02T12:13:40Z
• Started at 2026-09-02T12:29:44Z
• Started at 2026-09-02T12:45:03Z
• Started at 2026-09-02T13:11:46Z
• Started at 2026-09-02T13:41:07Z
• Started at 2026-09-17T13:36:31Z