fix: validate blob commitment points before batching

[AztecBot]

Summary

Blob commitment compression and batching accepted malformed BLS12-381 points that L1 would not accept as canonical EIP-4844 commitments. This change makes the blob crate validate the exact point representation it hashes and accumulates: canonical coordinates, canonical infinity encoding, and prime-order subgroup membership for hinted commitments.

Fix

• Require compressed commitment coordinates to be strict BLS12-381 Fq representatives before serialization.
• Validate hinted KZG commitment points are on-curve and in the prime-order subgroup before blob accumulation.
• Add regressions for modulus-as-zero infinity, noncanonical x + q, and non-subgroup commitments.

Testing

• nargo test --package blob modulus_y_infinity_point_fails --silence-warnings
• nargo test --package blob non_canonical_x_coordinate_fails --silence-warnings
• nargo test --package blob test_non_subgroup_commitment_point_fails --silence-warnings
• nargo test --package blob test_1_blob_batched --silence-warnings
• nargo test --package blob test_3_blobs_batched --silence-warnings

Issues

• Closes AztecProtocol/aztec-claude#1640 — reject non-G1 BLS12-381 commitments before scalar accumulation.
• Closes AztecProtocol/aztec-claude#2011 — reject modulus-as-zero infinity coordinates before compression.
• Closes AztecProtocol/aztec-claude#2036 — reject noncanonical non-infinity Fq coordinates before transcript binding.

---

Created by claudebox · group: rollup-audit-remediation