feat: enable recursion

[Oppen]

Summary

• Add recursion guest programs in bench_vs/lambda/: empty (no_std halt, inner program under test) and recursion (std verifier guest that deserializes a postcard-encoded (VmProof, elf, ProofOptions) and calls verify_with_options).
• Makefile: compile-recursion-elfs / clean-recursion-elfs targets; test-prover-all depends on compile-recursion-elfs.
• Raise MAX_PRIVATE_INPUT_SIZE from 6.7 MB → 64 MiB to fit a real VmProof as private input.
• Re-export ProofOptions from the prover crate so the verifier guest can name it without a direct stark dep.
• Add prover/src/tests/recursion_smoke_test.rs with ignored tests at two tiers: execute-only (in-VM verify, skips outer STARK prove) and full-prove (outer proof + host verify).
• Implement deterministic randomness for non-cryptographic use, needed for HashMap access in the guest

How to test

Build the guest ELFs first:

make compile-recursion-elfs

Run the cheapest regression guard (host-only encode/decode + verify, seconds):

cargo test -p lambda-vm-prover -- --include-ignored test_recursion_blob_decodes_and_verifies_on_host

Execute-only tier (in-VM verify, no outer prove, tens of GB RAM):

cargo test -p lambda-vm-prover -- --include-ignored test_recursion_execute_1query
cargo test -p lambda-vm-prover -- --include-ignored test_recursion_execute_empty

Full pipeline (outer STARK prove + verify, ~125 GB RAM):

cargo test -p lambda-vm-prover -- --include-ignored test_recursion_prove_1query

Or via make (builds ELFs + runs all ignored prover tests):

make test-prover-all

[Oppen]

/ai-review
/bench

[github-actions]

Codex Code Review

Found 2 issues:

1. Medium - public APIs expose crate-private hash aliases
   crypto/stark/src/lib.rs, crypto/stark/src/lookup.rs, prover/src/lib.rs, prover/src/tables/page.rs

   det_hash is pub(crate), but public structs/type aliases now expose HashMap from that private module, e.g. BusPublicInputs debug fields, FinalStateMap, FinalRegisterStateMap, FiniStateMap, and epoch_boundaries params. This is likely to trigger private_interfaces under -D warnings and also makes public API types harder for downstream crates to name. Make the deterministic hash aliases public, or avoid using the private alias in public signatures.

2. Low - normal make test now builds ignored recursion guests
   Makefile

   compile-programs now depends on compile-recursion-elfs, so make test and make test-executor build the full recursion guest even though all recursion smoke tests are #[ignore] and test-prover-all already depends on compile-recursion-elfs. That adds a heavy guest build to routine test paths with no test coverage benefit. Keep recursion ELF builds scoped to test-prover-all and the explicit compile-recursion-elfs target.

[Oppen]

/bench
/ai-review