Adapt the Mmcs gate interface

[4l0n50]

In order to use the recursive version of the verify_batch function, we need to open the commitment to multiple leaves (I used “leaves” everywhere, but writing this now I realize it may not be the right term).

On the other hand, in the recursive verification of FRI proofs, the bit decomposition of the index is already available. Therefore, the MMCS gate might avoid this conversion and work directly with the index bits.

This PR updates the MMCS gate to support multiple openings. To enable this, non-primitive operations now expose witness_exprs as Vec<Vec<ExprId>>. In the MMCS case, the last two vectors hold directions and root; the preceding |directions| vectors contain the openings for each matrix (previously referred to as “leaves,” possibly incorrectly), or an empty vector if there's no matrix at the respective level.

[sai-deng]

Can we also enable packing (it can be a separate PR)? As we only observe ext field elements now (make use of p3-multi-stark).

[sai-deng]

Previously: we’d call MmcsVerify multiple times, bottom→up, ending a segment whenever we hit a new leaf layer. I am wondering how current method is better than the old method?

[4l0n50]

Can we also enable packing (it can be a separate PR)?

It was initially supposed to work with packing, so it should be already working. I'll take a look.

Previously: we’d call MmcsVerify multiple times, bottom→up, ending a segment whenever we hit a new leaf layer. I am wondering how current method is better than the old method?

I’m not sure I understand what you mean by a segment. Before, we used to call MmcsVerify once for each batch of openings. However, openings for smaller matrices could only be passed as private inputs, which meant they couldn’t be reused elsewhere in the circuit.
Now, both the largest and the smaller matrix openings are provided as public inputs. Also, instead of using the index directly, we now use its bit decomposition, since that information is already available when MmcsVerify is called.