DomainSeparator::derive: mandatory (protocol_id, sponge_info, session) and remove new / .session()

[ricardo-perello]

Summary

This PR updates spongefish domain separation so Fiat-Shamir transcript initialization is derived from three explicit inputs:

• protocol_id: identifies the proof/protocol family;
• sponge_info: identifies the transcript / sponge / compilation context;
• session: identifies the invocation or application session.

The old DomainSeparator::new([u8; 64]) plus optional .session(...) path is removed. Callers now build a domain separator through:

DomainSeparator::derive(protocol_id, sponge_info, session).instance(&instance)

This keeps session binding mandatory at the spongefish API layer while still absorbing the instance separately before protocol messages.

Scope

This PR is intentionally scoped to the spongefish domain-separator API and its direct tests/examples.

It does not include DSFS packaging, ia-core, Argus integration, or codec relocation. Those are downstream / separate design work.

The cosmetic documentation/example preference changes from the earlier noisy branch were split out separately in #147.

Derivation

DomainSeparator::derive length-prefixes the triple:

LE32(|protocol_id|) || protocol_id ||
LE32(|sponge_info|) || sponge_info ||
LE32(|session|) || session

and absorbs it into spongefish's existing standard hash transcript. It then squeezes 32 bytes and places them in the existing 64-byte protocol tag slot as:

derived_32 || 0x00 * 32

This avoids adding a new default dependency and matches the agreed 32-byte derivation with zero padding for the existing 64-byte interface.

API Changes

• Add DomainSeparator::derive(protocol_id, sponge_info, session).
• Remove DomainSeparator::new.
• Remove optional .session(...) / .without_session() construction.
• Keep .instance(...) as the transition from domain data to prover/verifier transcript state.
• Add DOMAIN_SEPARATOR_MACRO_SPONGE_INFO for the domain_separator! macro's default compilation tag.
• Add DomainSeparatorPrefix for precomputing the (protocol_id, sponge_info) prefix when only the session varies.

Tests

• Updated domain-separator tests for the new mandatory derivation path.
• Updated StdHash and duplex transcript tests to use the derived tag.
• Updated the Schnorr example and direct docs/tests that used the old construction path.

Locally checked with:

cargo test -p spongefish

[ricardo-perello]

isnt this a breaking change? should be 0.7 no?

[ricardo-perello]

On the DomainSeparator::session point: the current branch already supports the staged use case where (protocol_id, sponge_info) are known/preprocessed first and the session is supplied later, via:

let prefix = DomainSeparatorPrefix::new(protocol_id, sponge_info);
let domsep = prefix.with_session(session).instance(&instance);

So the runtime-session flow is still possible, just surfaced through DomainSeparatorPrefix instead of the previous .session(...) builder. Do you specifically want the old .session(...) API restored for compatibility/scope reasons, or is the prefix builder acceptable if documented more clearly?