fix(crypto): use leanVM's setup_prover and prove one at a time

[TomWambsgans]

• ensure_prover_ready only called init_aggregation_bytecode, one of four steps in setup_prover, so leanVM's arena was never engaged and every prover buffer used the system allocator.
• With the arena on, only one proof may run at a time, so a permit guards each proving entry point.
• leanVM pin bumped to 380da82c.

[greptile-apps]

Greptile Summary

The PR updates the leanVM dependency and serializes proof-producing operations around leanVM's arena-backed prover.

• Replaces direct rec_aggregation and xmss usage with the lean-multisig facade.
• Splits prover and verifier initialization through setup_prover and setup_verifier.
• Adds a process-wide mutex permit to prevent concurrent proving operations.
• Recovers poisoned permits while recording the preceding prover panic.
• Updates crypto tests to import XMSS helpers through lean-multisig.

Confidence Score: 5/5

The PR appears safe to merge, with all existing proof-producing entry points serialized behind the process-wide permit.

The changed crypto wrapper consistently initializes the appropriate leanVM mode and acquires the same mutex before invoking each proof-producing aggregation, merge, or split operation; no concrete blocking failure remains.

Important Files Changed

Filename	Overview
crates/common/crypto/src/lib.rs	Switches aggregation APIs to lean-multisig, separates prover/verifier setup, and serializes all existing proof-producing entry points.
crates/common/crypto/Cargo.toml	Replaces direct leanVM subcrate dependencies with lean-multisig and adds the tracing dependency used for poison recovery diagnostics.
Cargo.toml	Pins xmss and the new lean-multisig workspace dependency to leanVM revision 380da82c.
Cargo.lock	Resolves the updated leanVM revision and the new lean-multisig dependency graph without an accepted changed-code defect.

Sequence Diagram

sequenceDiagram
  participant CallerA as Proving caller A
  participant CallerB as Proving caller B
  participant Setup as leanVM setup_prover
  participant Permit as PROVER_PERMIT
  participant Prover as leanVM prover
  CallerA->>Setup: ensure_prover_ready()
  CallerA->>Permit: lock()
  CallerA->>Prover: produce proof
  CallerB->>Setup: ensure_prover_ready()
  CallerB->>Permit: lock()
  Permit-->>CallerB: wait while A proves
  Prover-->>CallerA: proof
  CallerA->>Permit: unlock on guard drop
  Permit-->>CallerB: acquire
  CallerB->>Prover: produce proof

Loading

_{Reviews (1): Last reviewed commit: "fix(crypto): use leanVM's facade and pro..." | Re-trigger Greptile}

[MegaRedHand]

The repo config doesn't allow merging unsigned commits, so I manually cherry-picked it into the base PR: db7bc13

Thanks again for the help!