quotient-based subtraction-reduction for BN254

[xrvdg]

To optimise arithmetic on BN254 reduction is not performed after each arithmetic operations but delayed until the intermediate result doesn't fit in 256 bits.

PR adds

• MulShift — const-evaluable struct that derives Warren magic (m, s) for
  under-approximating ⌊val / P⌋ at compile time.
• two specialised divisors for commonly used limb sizes.
  • div_p_6b — approximation using the upper 6 bits of the high limb; achieves
    a quotient in [0, 4] with no multiplier, targeting ARM64/x86 add/lea instruction.
  • div_p_32b — approximation using the upper 32 bits; tighter quotient in
    [0, 5], targeting 32×32→64 multiplier hardware.
• subtraction_reduce — generic wrapper that applies any div_p variant and
  subtracts q * P via U64_P_MULTIPLES.
• Tooling
  • gen_multiples.py — generates the *_P_MULTIPLES table constants.
  • sub_reduce.py — analysis script comparing reduction strategies based on limb size.