feat: 2^32 memory address

[GunaDD]

feat: support 2^32 byte memory addresses

Raises the RV64 memory address space to the full 2^32 bytes. Since RV64_MEMORY_AS
stores u16 cells, that means cell pointers are now up to 31 bits wide
(POINTER_MAX_BITS: 28 → 31).

Why pointers become two limbs

A 31-bit pointer no longer fits safely in a single BabyBear field element, so every
pointer on the memory bus is now sent as two little-endian 16-bit limbs.
MemoryAddress.pointer becomes pointer_limbs: [T; 2], and the bus payload is
[address_space, ptr_lo, ptr_hi, data..., timestamp].

Main changes

• Memory system: MemoryAddress, memory bus, and offline checker switched to
  two-limb pointers. The persistent boundary AIR decomposes the merkle leaf label
  into range-checked limbs so the leaf pointer can be emitted without composing the
  full 31-bit value.
• Pointer conversion helpers (extensions/riscv/circuit/src/adapters/mod.rs):
  shared AIR + tracegen helpers that convert RV64 byte pointers (read from
  registers) into cell-pointer limbs using a carry witness plus range checks, and
  add per-block offsets with carries. Register-AS pointers always fit in the low
  limb, so register accesses skip the extra columns and range checks.
• Chip updates: every chip that accesses heap memory previously composed its
  pointer into a single field element; each now carries new witness columns and
  uses the shared helpers instead:
  • one carry column per base pointer for the byte→cell conversion (loadstore,
    hintstore, vec_heap family, keccak256 xorin, sha2);
  • one carry column per memory block for the base + block_offset addition in
    chips that do multi-block accesses (vec_heap family, keccak256, sha2);
  • register accesses take a cheap path: register pointers are tiny, so the high
    limb is constant zero and needs no carry or range check.
• CUDA: GPU tracegen updated to mirror the CPU side for all of the above
  (column/record layouts kept identical).
• Test utilities: gen_pointer now draws from the full 2^31 cell range. This
  also resolves jpw's TODO in the test config: tests used to call the general
  gen_pointer on the register address space, which forced the test MemoryConfig
  to artificially widen the register AS. Tests now use the new
  gen_register_pointer / gen_distinct_register_pointers, which draw from the
  real 32-slot register file (the distinct variant avoids collisions when a test
  writes several register operands), so the register-AS resizing workaround is
  removed.
• SHA-512 state alignment UB (extensions/sha2/circuit/src/sha2_chips/config.rs):
  the incremental hasher cast the record's state byte slice in place to
  &mut [u64; 8]. The state lives inside the trace-generation record buffer, which
  is only guaranteed 4-byte alignment (align_of::<Sha2RecordHeader>() = 4, since
  the header is all u32 fields), while [u64; 8] requires 8-byte alignment — so the
  cast was undefined behavior on host memory. Fixed by copying through an aligned
  local [u64; 8] buffer instead of reinterpreting in place.

Closes INT-8080

[github-actions]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[github-actions]

group	app.proof_time_ms	app.cycles	leaf.proof_time_ms
fibonacci	3,341	4,000,051	388
keccak	20,564	14,365,133	3,055
sha2_bench	10,281	11,167,961	992
regex	2,607	4,090,656	354
ecrecover	1,957	112,210	281
pairing	2,109	592,827	297
kitchen_sink	5,609	1,979,971	867

Note: cells_used metrics omitted because CUDA tracegen does not expose unpadded trace heights.

Commit: ff75195

Benchmark Workflow