Harden fiat-shamir challenger and WHIR verifier security surface

[XC0R]

Summary

Security-surface audit of the fiat-shamir challenger and WHIR verifier boundary. Addresses #184 and #177, plus surrounding error propagation and security budget validation.

• Rejection sampling (challenger.rs): replace bitmask truncation with rejection loop to eliminate modulo bias in sample_in_range(). Rejects field elements >= floor(ORDER/2^bits) * 2^bits.
• Merkle bounds check (merkle.rs, commit.rs): WhirMerkleTree::open() and MerkleData::open() return Option instead of panicking on out-of-bounds index.
• Error propagation (open.rs): prove() returns ProofResult instead of panicking. open_merkle_tree_at_challenges() propagates Merkle errors. ProverError::Proof variant added.
• Security budget audit (security_budget.rs): traces the full WHIR error budget. Confirms SECURITY_BITS=124 is achievable. Documents that 128-bit security is feasible under JohnsonBound with current parameters and 16-bit PoW (test_128bit_feasibility passes — the SECURITY_BITS TODO may be resolvable without larger digests).

Breaking change

Rejection sampling changes the Fiat-Shamir transcript when a sampled field element falls in the rejection zone. For typical parameters (bits <= 24, KoalaBear p = 2^31 - 2^24 + 1), rejection probability is < 1/p per sample — effectively never triggered.

Split option

If the prove() return type change (MultilinearPoint<EF> → ProofResult<MultilinearPoint<EF>>) is too broad for this PR, it can be split:

• Core: rejection sampling + Merkle bounds check (returns Option) + test suite. All within fiat-shamir/ + whir/.
• API: prove() returns ProofResult, error propagation through lean_prover/.

The test suite and rejection sampling are independent of the API change.

Files changed

File	Change
fiat-shamir/src/challenger.rs	Rejection sampling in sample_in_range()
whir/src/merkle.rs	open() returns Option
whir/src/commit.rs	MerkleData::open() returns Option
whir/src/open.rs	prove() returns ProofResult, error propagation
lean_prover/src/lib.rs	ProverError::Proof variant
lean_prover/src/prove_execution.rs	Handle prove() Result
fiat-shamir/tests/challenger_hardening.rs	4 tests: uniformity, transcript sync, determinism
whir/tests/security_budget.rs	4 tests: budget audit, 124-bit, 128-bit feasibility
whir/tests/run_whir.rs	Handle prove() Result

Closes #184. Closes #177.