Reject a composite modulus before a Pimpl exists, fixing a leak and a double free

[d-torrance]

Both library constructors that validate a modulus allocated their Pimpl
first and checked second. A constructor that throws never runs its
destructor, so each one had to clean up by hand, and they got it wrong in
opposite directions.

1. GroebnerConfiguration leaked on a composite modulus

It allocated the Pimpl, then rejected the modulus with
mathic::reportError, and nothing freed it. Under ASan on master,
RejectsCompositeModulus alone reports

Direct leak of 120 byte(s) in 1 object(s) allocated from:
    ...
SUMMARY: AddressSanitizer: 660 byte(s) leaked in 10 allocation(s).

once per rejected modulus, five times, on every run of the suite.

2. StreamStateChecker double freed on a composite modulus

    try {
      MATHICGB_STREAM_CHECK(isPrime(modulus), "The modulus must be prime");
      MATHICGB_ASSERT(mPimpl->debugAssertValid());
    } catch (...) {
      delete mPimpl;
    }

No rethrow, so the constructor completed with mPimpl dangling and the
destructor freed it again. Every other catch (...) in the sources cleans up
and rethrows, so this was an omission. It is reachable only by constructing
mgbi::StreamStateChecker directly -- through the public interface the
modulus comes from a GroebnerConfiguration, which has already refused it --
but IdealStreamChecker<Stream> takes its modulus from any stream, so it is
not purely hypothetical either.

The fix: check before the Pimpl exists

Both checks move into their Pimpl's own constructor. A Pimpl whose
constructor throws is never completed and never destroyed, and the
new-expression frees its storage, so neither outer constructor has a cleanup
path left to get wrong. The try/catch goes.

For GroebnerConfiguration this is also what keeps Debug working.
Pimpl::~Pimpl asserts debugAssertValid(), which requires a nonzero
modulus; the leak was the only reason a Pimpl holding a rejected modulus had
never been destroyed. Freeing it after the check would trip that assert in
RejectsCompositeModulus.

The Pimpl pointers stay raw. std::unique_ptr was the first attempt, and
was dropped: mathicgb.h keeps its members free of standard library types so
that a caller and the library built against different STLs agree on the
layout, and once the checks move, unique_ptr fixes nothing. The public
header is unchanged.

One message for a composite modulus

The two checks also reported differently -- GroebnerConfiguration said
"Modulus N is not prime. MathicGB only supports prime fields." as a
MathicException, the checker said "The modulus must be prime" as an
invalid_argument without saying which. The same message was built by hand in
two more places, MathicIO::readBaseField and SparseMatrix::read, and the
matrix reader's had drifted to "The modulus N".

checkModulusIsPrime, beside isPrime in PrimeField.hpp, now owns it, and
all four sites call it. It is a template so that readBaseField, whose
coefficient type is long and whose scanner accepts a sign, still rejects
-7 as "Modulus -7 is not prime" rather than converting it to a huge
unsigned value first.

User-visible changes:

• The checker's composite-modulus error is now a MathicException
  (runtime_error), like GroebnerConfiguration's. A composite modulus is
  bad input rather than a protocol violation; the checker's actual protocol
  errors are still invalid_argument.
• A matrix file with a composite modulus reports "Modulus N is not prime"
  rather than "The modulus N is not prime".

Commits

1. 583a683 -- the two constructors, the new function, and a regression test,
   StreamCheckerRejectsCompositeModulus.
2. 04146b6 -- MathicIO and SparseMatrix switch to the function.

Verification

• 254/254 in cmake Release and Debug, GCC 13.3, no build warnings.

• ASan, master against this branch:

  	master	this branch
  RejectsCompositeModulus	5 x 120 bytes leaked	clean
  StreamCheckerRejectsCompositeModulus	double free	passes
  StreamStateChecker(4, 2, 1), standalone program	double free	throws

• mgb gb on an ideal file with modulus -7, and with 4, reports
  ERROR: Modulus -7 is not prime. MathicGB only supports prime fields. and
  the same for 4.

No autotools distcheck run locally; neither commit touches a build system and
CI covers it.

🤖 Generated with Claude Code