Add optional proof-of-work grinding plumbing

[latifkasuli]

Goes towards #149.

Reworked on top of #231. The previous combined-row binding commit was dropped because transcript reads and writes are now absorbed unconditionally.

This adds optional proof-of-work immediately before the Zip+ column-opening challenges:

• Added pure BLAKE3 nonce search and verification. The seed is domain-separated and derived non-mutatingly from the current Fiat-Shamir transcript; the work message is seed || nonce_le || 0^24.
• The prover and verifier derive the seed after combined_row and before the nonce enters the transcript. The prover then searches and writes the nonce; the verifier reads and checks it. Normal transcript IO is therefore the nonce's only absorption.
• Search returns the smallest valid nonce deterministically in both sequential and parallel builds. Protocol configurations are capped at 32 grinding bits.
• Added ZipTypes::GRINDING_BITS, defaulting to 0. No production or benchmark configuration enables it, so the existing proof format and challenge schedule are unchanged by default.

This PR does not reduce NUM_COLUMN_OPENINGS or claim soundness credit for grinding. That requires a reviewed protocol argument isolating the protected query term. The enabled test configuration retains all 100 openings and adds exactly one u64 nonce.

Tests cover stable hash vectors, sequential/parallel determinism, search rollover, the zero-bit no-op, invalid configurations, missing and invalid nonces, proof-size accounting, end-to-end verification, and nonce tampering. The full .githooks/pre-push check passes.