rust, hashsig-glue: bump leanMultisig to devnet4 5eba3b1 (~2x aggregation throughput)

[ch4r10t33r]

Summary

Bumps rec_aggregation / leansig_wrapper / backend from the Apr-17 pin (2eb4b9d) to the current devnet4 head (5eba3b1, May 12).

Devnet operators reported ~16 sig/s aggregation throughput on 2eb4b9d versus ~37 sig/s on the leanMultisig benchmarks against 5eba3b1, against the same hardware. The dominant contributor is leanMultisig commit 939a767, which removed superfluous #[inline] annotations in eq_mle.rs for a measured +10% on AVX-512 (Hetzner AX42-U, same hardware class as the devnet aggregator hosts) with no NEON regression.

Commits picked up (2eb4b9d → 5eba3b1)

sha	what
0fbf27c	fix #198
89e0320 → 6a0d8fa	"eprint 055 ordering" commit + revert (no net diff)
d853f1c	update deps
939a767	remove #[inline] in eq_mle.rs (+10% AVX-512, neutral NEON)
7a71c0f	eq_mle base-case correctness fix (was using packing_width instead of log_packing_width)
5fbd5bf	mirror Plonky3 PR #1600: NEON carry-critical dot-product regression tests
e5c2183	leanSig dep flipped to main (devnet4 has been merged into main)
5eba3b1	rec_aggregation: expose structured BenchmarkReport (port from devnet5)

5eba3b1 itself is API-additive (new public run_aggregation_benchmark_report + per-node telemetry types); existing run_aggregation_benchmark is preserved as a thin wrapper, so nothing in this repo had to change to absorb it.

API adjustment in hashsig-glue

e5c2183 pulls in leanSig:main, which renamed SchemeAbortingTargetSumLifetime32Dim46Base8 → SIGAbortingTargetSumLifetime32Dim46Base8 in the production lifetime_2_to_the_32 instantiation. The test-only lifetime_2_to_the_8 kept the original Scheme... name. Only the production config import needs to flip; the test-config and test_scheme paths are untouched.

// rust/hashsig-glue/src/lib.rs (production config)
pub use leansig::signature::generalized_xmss::instantiations_aborting::lifetime_2_to_the_32::{
    PubKeyAbortingTargetSumLifetime32Dim46Base8 as XmssPublicKey,
    SIGAbortingTargetSumLifetime32Dim46Base8 as XmssScheme,
    SecretKeyAbortingTargetSumLifetime32Dim46Base8 as XmssSecretKey,
    SigAbortingTargetSumLifetime32Dim46Base8 as XmssSignature,
};

No other zeam code references the old type name.

Out of scope: recursive-aggregation review

The same review observation that flagged this bump also noted that, per spec, aggregators run recursive aggregation whenever helper payloads are available — 1.5–6 s wall — versus <600 ms for the non-recursive (gossip-only) fast-path that zeam already takes when selected_children.items.len <= 1 (pkgs/types/src/block.zig). Whether to widen that fast-path to always skip recursion on the produce path is a spec/operational design choice and is intentionally not part of this PR. Tracked separately.

Pre-commit checks

• cargo fmt --manifest-path rust/Cargo.toml --all -- --check — clean
• cargo clippy --manifest-path rust/Cargo.toml --workspace --no-default-features --features=libp2p,hashsig,multisig -- -D warnings — clean
• zig fmt --check . — clean
• zig build test --summary all — passed (491 s; xmss FFI test at 53 s, which is what would catch any ABI break)
• zig build simtest --summary all — passed (67 s)

Test plan

• Re-run benchmark on aggregator host with the new image; expect ~2x in lean_committee_signatures_aggregation_time_seconds p50.
• Watch zeam_aggregate_skip_total{reason="in_flight"} — should fall toward 0 since fewer passes will spill across the next slot.
• Rolling-deploy on one zeam_8 aggregator first; compare per-slot publish counts to a control before propagating.

[ch4r10t33r]

Folded into #903 (commit e99573b). Both changes are perf tuning for the multisig aggregator and want the same docker image cut + redeploy, so they belong together — see #903 for the combined review surface.