feat: add block_root_msgs_only_rollup circuit for no-tx blocks with messages (A-1375)

[spalladino]

Stacked on #24603 (A-1374). AZIP-22 Fast Inbox, FI-05.

What

Adds block_root_msgs_only_rollup (crate rollup-block-root-msgs-only, VK index BLOCK_ROOT_MSGS_ONLY_ROLLUP_VK_INDEX) — a non-first, transaction-less block that still inserts a non-empty L1→L2 message bundle. This lets a proposer keep draining the Inbox into a checkpoint when the tx pool is dry. It is completely inert pre-flip: nothing in the node produces this shape until FI-12.

Circuit

Modeled on the first-empty variant but for a mid-checkpoint position (block_root_msgs_only_rollup.nr):

• asserts num_msgs > 0 (a message-only block with no messages has no reason to exist);
• inherits start_sponge_blob and start_msg_sponge from the previous block (non-empty), sets is_first_block = false, appends the bundle to the L1→L2 tree and absorbs the message sponge, threads the start sponge blob through unchanged (no tx effects);
• deliberately cannot be leftmost — the checkpoint root requires the leftmost rollup's is_first_block to be true.

Composes via a new new_from_no_rollups_with_start_sponge_blob (a new_from_no_rollups that takes an inherited sponge blob instead of an empty one; the first-empty variant now delegates to it, preserving its empty-sponge start).

Wiring

• BLOCK_ROOT_MSGS_ONLY_ROLLUP_VK_INDEX added to the vk tree and the ALLOWED_PREVIOUS_VK_INDICES of the block-merge and both checkpoint-root variants.
• New crate + Nargo registration; pinned-build.tar.gz regenerated.
• TS: proving request type + schema + ProvingJobResultsMap entry, the ServerCircuitProver interface method and all implementers (bb-prover, TestCircuitProver, MockProver, BrokerCircuitProverFacade), the proving-broker queue map + priority list + job-controller dispatch, and npct artifact/type generation.

Tests

Noir (rollup_lib, 386 passed) covers the roadmap done-when — a checkpoint [first block, msgs-only block, normal block] — plus the failure cases: num_msgs == 0 rejected, a msgs-only block cannot be leftmost, and merge continuity catches a bad hinted start_msg_sponge. yarn build, lint, and the orchestrator + proving-broker suites (123) are green. Cross-chain l1_to_l2 e2e: only the two pre-registered-flaky duplicate-consume cases fail (a pre-existing PXE nullifier-sync issue, unrelated). A codex review found no soundness or wiring bugs.

Deferred to FI-12/FI-15 (orchestrator selection + integration test)

block-proving-state.ts selecting this variant, and an orchestrator integration test driving a mid-checkpoint msgs-only block, are intentionally not in this PR. Driving one requires reworking the transitional per-block message distribution: today the first block carries the whole padded checkpoint bundle and non-first blocks inherit the full checkpoint sponge and absorb nothing, so a msgs-only block absorbing real messages mid-chain would break both the block-merge right.start_msg_sponge == left.end_msg_sponge continuity and the checkpoint-root merged.end_msg_sponge == parity.end_sponge check. That distribution rework belongs with the sequencer that actually produces these blocks (FI-12) and its live-path e2e (FI-15). The circuit is fully proven by the noir tests, and the existing BlockProvingState guard still rejects non-first zero-tx blocks, so nothing can construct the shape until that work lands.