gen-rust: generate the corpus receipt Merkle tree (corpus_merkle.t27 + sha256.t27) into t27c, replacing cr_root/cr_sha glue (Refs #7576, #7469) #7577

Part of #5980. Found while doing #7576.

Gap

specs/verified/corpus_merkle.t27 runs the RFC 6962 tree of the corpus receipt (#7576) over specs/tri/crypto/sha256.t27, and its tests pass against hashlib vectors. gen-rust cannot lower it yet, because the tree hashes byte slices (update(&s, path), left[0..32]) through a &mut state parameter. That is #7469.

So t27c computes the same tree with hand-written glue in bootstrap/src/main.rs:

• cr_sha folds parts through the sha2 crate;
• cr_root recurses with split_point, LEAF_PREFIX and NODE_PREFIX from the generated bootstrap/gen/rust/verified/corpus_receipt.rs.

The split rule and the prefixes come from the spec. The hashing and the recursion are still Rust, and the only thing that ties them to the spec is the vectors in corpus_merkle.t27, which nothing runs against the Rust copy.

Change

1. When gen-rust: slices, byte-slice parameters, and &mut for pointer parameters (Refs #7332) #7469 lands, generate bootstrap/gen/rust/verified/corpus_merkle.rs and bootstrap/gen/rust/tri/crypto/sha256.rs.
2. Replace the bodies of cr_sha and cr_root with calls into the generated code.
3. Drop the sha2 use from those two functions. t27c: drop sha2 from tt_manifest.rs and tt_debug.rs (port to .t27 or owner exception) #7499 covers the crate itself.

gen-rust does not lower test blocks either. Until it does, nothing runs the spec's vectors against the generated copy.

Done when

• cr_root in main.rs is a call into generated code, not a recursion.
• t27c corpus-receipt sign gives byte-identical receipts before and after the change, for one corpus run.

Boundary

• specs/tri/crypto/sha256.t27
• specs/verified/corpus_merkle.t27
• bootstrap/gen/rust/tri/crypto/sha256.rs
• bootstrap/gen/rust/verified/corpus_merkle.rs
• bootstrap/gen/rust/verified/corpus_receipt.rs
• bootstrap/src/main.rs

User Scenarios

• Given the corpus Merkle tree spec (corpus_merkle.t27) and SHA-256 spec (sha256.t27) with passing test vectors, and the hand-written cr_sha/cr_root glue in bootstrap/src/main.rs, When gen-rust lowers both specs after gen-rust: slices, byte-slice parameters, and &mut for pointer parameters (Refs #7332) #7469 lands and the glue is replaced with calls into the generated corpus_merkle.rs and sha256.rs, Then t27c corpus-receipt sign produces byte-identical receipts before and after the change for a corpus run.

Requirements

FR-001: gen-rust MUST generate bootstrap/gen/rust/verified/corpus_merkle.rs from specs/verified/corpus_merkle.t27 once #7469 is implemented.
FR-002: gen-rust MUST generate bootstrap/gen/rust/tri/crypto/sha256.rs from specs/tri/crypto/sha256.t27 once #7469 is implemented.
FR-003: The cr_sha function in bootstrap/src/main.rs MUST be replaced with a call into the generated sha256.rs code and MUST NOT use the sha2 crate directly.
FR-004: The cr_root function in bootstrap/src/main.rs MUST be replaced with a call into the generated corpus_merkle.rs code and MUST NOT contain manual recursion logic.
FR-005: The generated code MUST use the split rule, LEAF_PREFIX, and NODE_PREFIX from the spec (via corpus_receipt.rs).
FR-006: t27c corpus-receipt sign MUST produce byte-identical receipts before and after the replacement for at least one corpus run.