check-public-inputs cli tool

[ashpect]

Summery :
This PR adds a new CLI command check-public-inputs that verifies the public inputs stored in a proof file (proof.np/proof.json) match the witness values from the original Noir circuit execution. This enables users to detect if public inputs have been tampered with by an attacker.
Motivation
When a proof is generated, the public_inputs are stored in the proof file:

{
  public_inputs: [
    0500000000000000000000000000000000000000000000000000000000000000,
    0b00000000000000000000000000000000000000000000000000000000000000
  ],
  whir_r1cs_proof: { ... }
}

This tool allows verification that the public inputs in a proof match what would be computed from the original circuit and inputs.

How It Works :

1. Circuit Analysis: Parses the compiled circuit.json (from nargo compile) to extract public input witness indices from public_parameters and return_values in the ACIR bytecode.
2. Witness Extraction: Reads the witness file (.gz from nargo execute) which contains the full solved witness vector.
3. Comparison: Extracts witness values at public input indices and compares them against the public_inputs array in the proof file.

Soundness : The soundness comes from Noir's deterministic witness solving. Given the same circuit and inputs, nargo execute always produces the same witness vector in a fixed order. By sorting public inputs by their ACIR witness index, we establish a canonical ordering that matches how the prover stores them.

Summary of Changes :

• New CLI command (check-public-inputs): Takes compiled circuit JSON, witness file from nargo execute, and proof file; verifies public inputs match
• Fix public input ordering: Sort public input builders by ACIR index in splitter.rs to ensure R1CS witness order matches ACIR index order
• Helper scripts: Add execute-circuits.sh and check-public-inputs.sh for noir-passport tbs720/tbs1300 verification
• Backwards compatibility: It is needed to regenerate .pkp files after merge to main