…path

Replace the recursive Tx.toBuffer() chain (Buffer alloc at every node,
Buffer.concat at every level) with a single growable ArrayBuffer the whole
object graph streams into and that is sliced once at the root.

The migration contract is the optional-sink overload:
  toBuffer(): Buffer;
  toBuffer(sink: BufferSink): void;
Pass a sink and it writes + returns undefined; omit it and it returns its
own buffer. Unmigrated children fall back via return value, so it lands
incrementally and existing toBuffer() callers keep working.

Converts the Tx spine end-to-end: Tx/TxArray, TxHash/TxHashArray,
PrivateKernelTailCircuitPublicInputs (+partials), PrivateToRollupAccumulatedData,
ChonkProof/ChonkProofWithPublicInputs, HashedValues, Vector, BaseField.

BufferSink.writeBigInt uses 4x DataView.setBigUint64 limbs for 32-byte
fields (no hex round-trip, no per-field alloc). On a modeled rollup Tx
(~2660 fields) byte-identical to today and ~11x faster end-to-end; the
naive per-byte shift loop is actually slower than legacy, so picking the
right field encoder is the win.

Adds toBuffer cases (private + public) to stdlib/src/tx/tx_bench.test.ts
recording per-op microseconds + payload bytes; wired into CI via the
existing bench_cmds entry, dashboard series Tx/{private,public}/toBuffer/*.

fromBuffer/zod path is unchanged and out of scope.

…r ~9x Tx.toBuffer

Real bench (stdlib/src/tx/tx_bench.test.ts) on this PR's spine-only baseline vs after:
- Tx/private/toBuffer:           1.96 ms -> 0.22 ms (~8.9x)
- Tx/public/toBuffer:            3.11 ms -> 0.34 ms (~9.1x)
- Tx/private/toBufferReusedSink: 1.86 ms -> 0.16 ms (~12x)
- Tx/public/toBufferReusedSink:  3.04 ms -> 0.29 ms (~10.5x)

cpu-prof on the prior code showed serializeToSink dominating ~50% of total time:
the rest-args + Array.isArray + Buffer.isBuffer + 5x typeof dispatch ran per element
of every nested array, and serializeToSink(sink, ...obj) allocated a fresh
rest-args array for each recursion (1632-element spread per ChonkProof, every call).

Changes:

- foundation/serialize/buffer_sink: split dispatch into per-element serializeOneToSink
  and an inner serializeArrayToSinkInner that recurses with the array reference, no
  spread. Hot-path objects exposing toBuffer first so Fr/Fq/migrated leaves skip the
  primitive-typeof chain. serializeArrayToSink uses the same inner.

- foundation/curves/bn254/field: BaseField caches its 32-byte serialized form. The
  cache is populated eagerly in the constructor when built from a 32-byte Buffer (the
  deserialization path) and lazily on first toBuffer otherwise. toBuffer returns a
  defensive Buffer.from copy or writes the cached bytes straight into a sink, with no
  bigint->bytes round-trip on the hot path. The Buffer ctor copies via new Uint8Array
  to defend against caller-side mutation; the copy-ctor aliases the cache (it is never
  mutated post-assignment).

- stdlib/tx/tx: pre-size the BufferSink with the last serialized length so the
  no-sink fresh-allocation path skips the 1k->64k doubling-growth cost. Hint lives
  in a module-level WeakMap rather than an instance field so deep-equality assertions
  on Tx (which compare enumerable own properties) are unaffected.

Adds buffer_sink.test.ts covering the new BufferSink module: byte-for-byte
equivalence of every sink writer against the legacy serializeBigInt/free_funcs,
serializeToSink dispatch (mixed/nested/migrated/legacy-node fallback), capacity
growth, reset reuse, overflow/negative guards, and a sink->BufferReader round-trip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…constant

The per-instance WeakMap + process-wide largest-seen-size heuristic both
existed only to pre-size the BufferSink the no-sink Tx.toBuffer() path
allocates. The bootstrapped bench measures the actual Tx payloads at:

- private-only:               81763 bytes
- public-with-enqueued-calls: 129128 bytes

A single 131072-byte (128 KiB) presize covers both shapes without any
doubling-growth ensure() resize on the cold path, and is the same
allocation the WeakMap fast-path made on the steady-state hot path
anyway. Removing the hidden state matches Adam's review feedback and
brings the bench numbers within noise of the WeakMap version:

  variant            weakmap (prev)  constant (this)
  private steady     220 us          ~244 us
  public  steady     325 us          ~351 us
  private reused     167 us          ~176 us
  public  reused     266 us          ~276 us
  private cold       ~275 us         ~273 us
  public  cold       ~445 us         ~427 us

Real-world Txs that exceed 128 KiB keep working — the sink falls back
to its standard doubling growth, just paying the existing cost.

…ng value

The (0x0123456789abcdefn, 7) case was 57 bits (high byte 0x01) but width=7
only holds 56 bits. Legacy serializeBigInt silently truncates the high byte;
the new writeBigInt is strict and throws to match its 32-byte path. Drop the
overflowing high byte so the value fits, keeping the test's stated intent
(\"matches serializeBigInt byte-for-byte\") aligned with both impls. The
out-of-range strictness is already covered by the dedicated
\"rejects out-of-range bigints\" block.