hardening: ed25519 verify_strict + mithril-client re-exports

[Sbcdn]

Summary

Two small, independent hardening changes against main:

1. Genesis ed25519 path now uses verify_strict. Matches upstream ProtocolGenesisVerificationKey::verify exactly. Adds the small-order checks on R / A and the un-cofactored verification equation. Closes the only meaningful flavour of the unjournaled-genesis-VK substitution discussed in the recent security review (low-order public-key shortcut). The broader input-binding obligation remains a consumer-side check on chain_output.genesis_hash, which is information-equivalent to pinning the VK directly.

2. Re-export AggregatorDiscoveryType and GenesisVerificationKey from mithril-client. The new ClientBuilder::new(...).set_genesis_verification_key(...) constructor pattern in Mithril 2617.0 requires both argument types. Downstream host consumers can now reach them through mithril-dwarf without taking mithril-client on as a direct dep (which would force a version-pin coordination problem with the transitive mithril@7e787deef).

Cycle cost

Measured in oaks_cert with --features guest-bench: +49,800 RISC0 cycles per chain, genesis-only path (one call per chain). Against the per-cert standard verification cost this is well under 0.02% of a one-cert chain proof. Host-side instruction counts from benches/ed25519_strict.rs (iai-callgrind) corroborate the ratio.

Divergence registry

Divergence #2 (Ed25519 non-strict) closed and removed from tests/intentional_divergences.rs. Audit-trail entry kept in the closed-divergences block of the module header. README divergence count updated 5 → 4. Stale "non-strict ed25519" commentary trimmed from mithril-dwarf-harness/src/{checks_genesis,mutation,report,types}.rs.

Regression detector

New unit pin ed25519_rejects_small_order_public_key in src/certificate_verification/mod.rs exercises identity-VK rejection through the production entrypoint. Any future revert to non-strict vk.verify fails this test immediately.

Test plan

• cargo test -p mithril-dwarf --release --lib (incl. new small-order pin)
• cargo test -p mithril-dwarf-harness --test equivalence --release — 12/12 pass
• cargo test -p mithril-dwarf-harness --test intentional_divergences --release — 6/6 pass (one less than before, readme and test fixes #2 removed)
• cargo build --release --features host — re-exports compile cleanly
• cargo bench --bench ed25519_strict — iai-callgrind delta documented
• RISC0 measurement in oaks_cert — +49,800 cycles confirmed

Files

• src/certificate_verification/mod.rs — verify → verify_strict at the genesis call site; new small-order pin test.
• src/lib.rs — two additive re-exports under the existing #[cfg(feature = "host")] block.
• benches/ed25519_strict.rs (new) — host-side iai-callgrind comparison of the two verify paths; kept as cycle-delta evidence and regression detector for future dalek bumps.
• Cargo.toml — register the new bench target.
• mithril-dwarf-harness/tests/intentional_divergences.rs — drop divergence readme and test fixes #2 entry; keep audit-trail note.
• mithril-dwarf-harness/src/{checks_genesis,mutation,report,types}.rs — trim stale non-strict commentary.
• README.md — divergence count + example list updated.