feat: Easier to use Fiat-Shamir transcript

[Tabaie]

Introduces a debug-friendly Fiat-Shamir transcript that does not require challenge names to be registered up front.

Each transcript records the protocol layout as it is used: challenge names, the number of bindings per challenge, and nested sub-protocol structure. That layout can be exported and supplied to a fresh transcript instance, which will then verify that calls happen in the same order and shape, returning readable errors on mismatches.

In tests, we export the layout from the prover transcript and replay it on the verifier transcript. In production this does not affect soundness, but it is mainly useful as a debugging and consistency check.

---

Note

Medium Risk
Replaces the Fiat–Shamir transcript implementation and alters how challenges are derived/bound in both prover and verifier, which can change challenge values and break proof compatibility if misused. The change is localized and covered by a new unit test, but it touches core cryptographic flow.

Overview
Adds a new internal/fiatshamir transcript that does not require pre-registering challenge names, and can optionally record and replay a ProtocolLayout (including nested sub-protocol structure and expected binding counts) to produce readable mismatch errors.

Updates prover and verifier to drop gnark-crypto/fiat-shamir usage and instead derive challenges via Transcript.Challenge(name, bindings...), binding commitments directly at challenge time (and binding setup root once up front). Adds a unit test that exports the prover-side layout and replays it on a verifier-side transcript to validate ordering and error behavior.

Cleans up module dependencies (go.mod/go.sum) by adding testify and pruning/transitively adjusting sums.

^{Reviewed by Cursor Bugbot for commit 163cdbb. Bugbot is set up for automated code reviews on this repo. Configure here.}