test(crypto): cover the Falcon polynomial ring

[mehmetkr-31]

Part of #3487 — second slice, covering math/polynomial.rs. Draft while I wait to be assigned on the issue.

field.rs is #3542; the two are independent and can land in either order.

Rationale

670 lines, one test — and it covered only the negacyclic reduction. Unlike field.rs, the doc comments here are already decent, so this slice is tests rather than docs.

Two bugs fell out of writing them; neither fix is in this PR.

Not here: the Polynomial::div zero-dividend fix

@Sertug17 found that one first, filed #3534 on 31 July, and has a fix in 0xMiden/crypto#1106. That repo is archived so it cannot land there; they are opening a fresh PR against this one. I had included the fix here before spotting their issue, and removed it at their request — this PR is now purely tests.

Reported, not fixed: vector_karatsuba on odd lengths

It splits at n / 2 and reassembles the high half at offset n. For odd n the high half holds ceil(n/2) coefficients, one more than that offset accounts for, so the final loop indexes past the end of product. The zip that builds the middle term also silently drops the top coefficient of the high half in the same case.

Lengths 9 and 17 panic against next today (index out of bounds: the len is 17 but the index is 17).

I deliberately did not fix this. Falcon only ever calls it with N = 512, so it is latent — but Polynomial::karatsuba is public API, and the fix is a choice between handling odd splits correctly and making the power-of-two precondition explicit. That reads like a maintainer decision rather than something to slip into a test PR. The test covers powers of two only, with the reason written next to it. Happy to do either fix.

Test plan

cargo test -p miden-crypto --lib falcon512_poseidon2::math::polynomial
cargo test -p miden-crypto --lib
cargo clippy -p miden-crypto --all-targets

The suite checks properties against independent references rather than restating the implementation:

Area	How it is checked
degree / lc	trailing zeros, all-zero, and empty cases, which is_zero is defined in terms of
reduce_by_cyclotomic	X^n = -1, X^(n+1) = -X, X^2n = +1 pinned directly — the alternating sign is the least obvious code in the file
galois_adjoint	evaluated at points, against f(-x)
lift_next_cyclotomic	evaluated at points, against f(x^2)
field_norm	against the even/odd split of formula 3.25 in the spec
karatsuba	against schoolbook multiplication, straddling the length-8 recursion cutoff
multiplication	proptest on the evaluation homomorphism
addition	proptest that subtraction undoes it, across differing lengths
Hadamard ops	division equals multiplication by the inverse; zeros invert to zero without trapping
division	recovers the cofactor of a known factorisation

Results

cargo test -p miden-crypto --lib passes (689 tests). Clippy over miden-crypto --all-targets is clean under -Dwarnings, and cargo fmt --check reports nothing.

[Al-Kindi-0]

We should close in favor of #3629, which resolves #3487 with a complete documentation, testing, and hardening pass over the Falcon math module, covering the change proposed here.