Rotom: Roll arguments can name a whole tensor axis

[edwjchen]

Part 3 of #2980 and stacked on #3170

A Rotom roll decorates a layout: roll(from, by) rewrites the from index by subtracting the by argument's index. Until now a roll argument could only be a piece, a position in the dims list. This PR lets it also be a whole tensor axis, spelled axis N and stored as -(axis+1) in the flat rolls array.

// Piece arguments: Halevi-Shoup diagonal of a 4x4 matrix, slot j of
// ciphertext i holds A[i, (j - i) mod 4].
#diag  = #rotom.layout<n = 4, rolls = [(1, 0)], dims = [[0:4:1] | [1:4:1]]>

// Axis 1 is split across two pieces, so the whole-axis roll names it.
// How to read this: `axis 1` refers to `[1:4:4], [1:4:1]` and `2` refers to piece 2 or `[0:16:1]`
#split = #rotom.layout<n = 16, rolls = [(axis 1, 2)],
                       dims = [[1:4:4], [1:4:1] | [0:16:1]]>

• Piece FROM rewrites only that piece's mixed-radix digit, leaving the axis's other digits untouched. This is the original per-piece reading, now materialized correctly on split axes (no borrow leaks across digits).
• Axis FROM rewrites the whole axis index modulo its full extent; each piece then takes its digit of the rolled index, so the shift borrows across digits.

[j2kun]

@edwjchen Could you rebase this one?