Enforce PCS transcript iterator cardinality

[latifkasuli]

Follow-up to #231.

PcsProverTranscript::write_const_many_iter currently sizes and zero-fills the proof stream from the declared length, then zips those chunks with the supplied iterator. A short iterator therefore leaves zero-filled proof elements that the prover never absorbs, while the verifier later reads and absorbs them. A long iterator is silently truncated, and an overflowing declared length can panic.

This PR:

• requires the iterator to yield exactly the declared number of elements;
• returns a typed InvalidInput error for underflow, overflow, zero-width encodings, and length arithmetic overflow;
• serializes first and absorbs only after exact cardinality is established, so a rejected write leaves proof bytes, cursor, and Fiat-Shamir state unchanged;
• preserves the existing per-element transcript framing for valid writes.

The transcript-v1 snapshot pins the existing proof bytes and next challenge for an exact write. A focused Zip+ IPRS/Prove(batch=1, poly_size=2^12) Criterion run measured 494.63 us on main and 495.46 us with this implementation; proof size remains 150,380 bytes. The discarded transcript-clone prototype measured 517.56 us under the same configuration.

Tests cover exact writes, short/empty/long inputs, zero-width encodings, overflowing lengths, non-ExactSizeIterator inputs, atomic rollback, the transcript-v1 compatibility snapshot, PCS round trips, protocol round trips, and existing tamper cases. Proof-stream encapsulation is intentionally deferred to a separate follow-up.