feat(ci): refresh pinned barretenberg gate counts

[AztecBot]

Stacked on #23400. Mirrors the ci-refresh-chonk refresh-label / commit-message-marker pattern for the pinned barretenberg gate counts that today live as hardcoded literals in gate_count_constants.hpp.

What changed

• barretenberg/cpp/scripts/gate-counts.json is now the canonical fixture for every measured gate count, kernel ECC row, ultra-ops count, and HONK recursion tuple that the C++ test suite pins.
• barretenberg/cpp/scripts/gen_gate_count_constants.py regenerates barretenberg/cpp/src/barretenberg/dsl/acir_format/gate_count_constants.hpp from the JSON. The header now carries a DO NOT EDIT BY HAND banner; --check mode lets CI guard against hand edits.
• barretenberg/cpp/src/barretenberg/dsl/acir_format/gate_count_fixture.hpp exposes BB_OBSERVE_GATE_COUNT(key, value). The macro is a no-op unless BB_GATE_COUNT_OBSERVED_DIR is set, in which case it records {"key": "<key>", "value": <observed>} to a per-process .jsonl file. Header-only so any test target can call it without picking up a new link dep.
• Every existing EXPECT_EQ(measured, NAMED_CONSTANT) site in the centralized header now pairs with a BB_OBSERVE_GATE_COUNT(...) call so the refresh round-trip captures the observed value alongside the existing assertion.
• barretenberg/cpp/scripts/merge_observed_gate_counts.py folds an observed-dir worth of JSONL records back into gate-counts.json. Handles both flat keys (ROOT_ROLLUP_GATE_COUNT) and structured keys (HONK_RECURSION_CONSTANTS::<flavor>::<mode>::<gates|ultra_ops>).
• barretenberg/cpp/scripts/ci_update_gate_counts.sh is the new PR push-back script, modeled on ci_update_chonk_inputs.sh. It runs the gate-count tests under BB_GATE_COUNT_OBSERVED_DIR, merges into JSON, regenerates the header, stages both files, and pushes a chore(bb): refresh pinned gate counts commit with --ci-skip so the follow-up run is suppressed.
• .github/ci3_labels_to_env.sh, .github/ci3_success.sh, ci.sh, root bootstrap.sh, and barretenberg/cpp/bootstrap.sh add the ci-refresh-gates / --ci-refresh-gates shape. Main CI is skipped; post-actions dispatch bootstrap_ec2 "./bootstrap.sh ci-gate-count-update", which builds dsl_tests, stdlib_eccvm_verifier_tests, stdlib_honk_verifier_tests and invokes the refresh script.
• .claude/skills/gate-counts/SKILL.md documents the local commands (refresh, regenerate, check) and the review checklist.

Refresh flow at a glance

1. Apply ci-refresh-gates label or include --ci-refresh-gates in the head commit. Main CI sees CI_MODE=skip.
2. Post-actions spin up an EC2 instance, build the gate-count test targets, run them with BB_GATE_COUNT_OBSERVED_DIR=$dir, merge the observed JSONL files into gate-counts.json, regenerate the header, and push a --ci-skip commit back to the PR head.
3. The PR now contains the updated JSON + header; a follow-up CI run can be triggered normally if desired.

Scope

• This first PR fixture-ifies the centrally tracked constants in gate_count_constants.hpp (root rollup, chonk, ECCVM, goblin AVM, init/inner/tail/hiding kernel gates+ECC+ultra-ops, and every HONK recursion tuple).
• The templated per-opcode constants (RANGE_32, SHA256_COMPRESSION, etc.) and one-off literals like the disabled EXPECT_GATE_COUNT = 1203700 in avm2_recursion_constraint.test.cpp are deliberately out of scope here; the new macro is a drop-in for them in a follow-up.

Test plan

• Verify the regenerated header is byte-identical to the pre-PR pinned values (only the DO NOT EDIT banner and a stale // Trigger rebuild comment differ — confirmed locally).
• Apply ci-refresh-gates to a PR with a deliberately stale value and confirm the post-actions job rewrites gate-counts.json + gate_count_constants.hpp and pushes the --ci-skip commit back.
• Locally: BB_GATE_COUNT_OBSERVED_DIR=$(mktemp -d) barretenberg/cpp/scripts/run_test.sh dsl_tests '*GateCount*' then barretenberg/cpp/scripts/merge_observed_gate_counts.py $BB_GATE_COUNT_OBSERVED_DIR produces the expected (empty) diff against the current pin.
• python3 barretenberg/cpp/scripts/gen_gate_count_constants.py --check exits 0.

---

Created by claudebox · group: slackbot