starknet_os: add the privacy proof-fact leaf digest

[einat-starkware]

First PR of the privacy proof-fact fold stack (OS-side design: reproduce the proving side's recursive proof-tree digest fold so the circuit verifier's output digest can be compared against an OS-computed value).

This PR adds only the leaf layer of the digest chain, in Rust: starknet_os::proof_fact_fold with compute_leaf_output_digest — one transaction's leaf output digest, blake2s(encode_felt252s_to_u32s(proof_facts[2..])) (dropping the proof version and variant markers, keeping [program_hash, ...virtual OS output]), exactly the preimage the leaf simple bootloader hashes to its own output.

Tested against a golden value taken from the proving side (stwo_run_and_prove_recursive_tree tests).

Stack: this PR ← rust tree fold ← cairo leaf digest ← cairo tree fold ← OS output wiring (#15064) ← registry pin (#15086) ← verifier task (#15088).

🤖 Generated with Claude Code

https://claude.ai/code/session_01XmPJM3Wph4QLmFmhcxVsh4

---

Generated by Claude Code

[cursor]

PR Summary

Low Risk
New isolated module and golden test only; no changes to execution, verification, or existing OS paths.

Overview
Introduces starknet_os::proof_fact_fold, the first OS-side piece of the privacy proof-fact fold stack. It computes a single transaction’s leaf output digest the same way the proving side does: Blake2s over u32-encoded felts from proof_facts[2..] (skipping the two version markers, keeping program hash and virtual OS output).

Adds a small blake2s_over_u32_words helper and exports digest types as eight little-endian u32 words. A unit test locks the leaf digest to a golden from stwo_run_and_prove_recursive_tree; nothing in the OS runner is wired to this yet—that comes in later stack PRs.

^{Reviewed by Cursor Bugbot for commit 511537c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[Yoni-Starkware]

@Yoni-Starkware made 1 comment.
Reviewable status: 0 of 3 files reviewed, 1 unresolved discussion (waiting on einat-starkware).

---

crates/starknet_os/src/proof_fact_fold.rs line 25 at r1 (raw file):

}

pub fn blake2s_over_u32_words(words: &[u32]) -> Blake2sDigestWords {

See if you can use the stwo's impl

[einat-starkware]

crates/starknet_os/src/proof_fact_fold.rs line 25 at r1 (raw file):

Previously, Yoni-Starkware (Yoni) wrote…

See if you can use the stwo's impl

Added a comment referencing the crate

[Yoni-Starkware]

@Yoni-Starkware partially reviewed 3 files, made 1 comment, and resolved 1 discussion.
Reviewable status: all files reviewed (commit messages unreviewed), all discussions resolved (waiting on einat-starkware).