[DON'T MERGE] Reject non-canonical Goblin transcript coordinates

[AztecBot]

Summary

Mega/Goblin recursive commitment decoding reconstructed BN254 Fq coordinates from raw goblin limbs without the strict canonicality check used by native and Ultra verification. This could let aliased transcript coordinates diverge from native verification behavior, so the proportionate fix is to reject non-canonical limbs at the StdlibCodec/goblin_field boundary.

Fix

• Make goblin_field::assert_is_in_field() delegate to the strict BN254 Fq bigfield check.
• Call that check when StdlibCodec deserializes goblin_field values, before decoded coordinates enter transcript state.
• Add regressions for q and x + q encodings, update Mega gate-count expectations, and refresh the codec documentation.

Testing

• cmake --build --preset default --target stdlib_primitives_tests -j$(nproc)
• ctest --preset default -R 'stdlib_field_conversion' --output-on-failure
• cmake --build --preset default --target goblin_tests -j$(nproc)
• Attempted ctest --preset default -R 'GoblinRecursiveVerifierTests\.Basic$' --output-on-failure; blocked by missing /home/aztec-dev/.bb-crs BN254 CRS.

Issues

• Closes AztecProtocol/barretenberg-claude#2797 — Mega/Goblin recursive commitment canonicality.
• Closes AztecProtocol/barretenberg-claude#2565 — companion goblin-field canonicality boundary.

---

Created by claudebox · group: bb-audit-remediation