chore: backport #20926 (remove epk sign from message payload) to v4

[AztecBot]

Backport of #20926 to v4.

This removes the ephemeral public key sign byte from the encrypted message payload. Instead, the sender now generates ephemeral key pairs with guaranteed positive y-coordinates, so the sign byte is no longer needed. This frees up one byte of capacity and reduces information leakage in the logs.

The automatic cherry-pick failed due to conflicts in encoding.nr and aes128.nr, caused by differences between next and v4 (different MESSAGE_CIPHERTEXT_LEN values and the absence of AES128_PKCS7_EXPANSION_IN_BYTES on v4). Conflicts were resolved by adapting the changes to v4's constants while preserving the intent of the original PR.

Changes:

• Added generate_positive_ephemeral_key_pair() to ephemeral.nr
• Removed EPH_PK_SIGN_BYTE_SIZE_IN_BYTES constant and its usage from encoding.nr
• Updated aes128.nr to use positive ephemeral keys and remove sign byte from wire format
• Updated arithmetic generics utils to remove the + 1 for the sign byte

ClaudeBox log