fix(groth16): remove the public unblinded prove API; deterministic prover becomes an unpublished test fixture (#50)

[satran004]

Summary

Closes #50 (consolidated triage C-01, Phase 1 of #54). Groth16ProverBLS381.proveUnblindedWithReaders(...) was a public main-source API that fixed the Groth16 blinders to r = s = 0 and therefore produced deterministic, non-zero-knowledge proofs from the ordinary prover surface. Both independent Groth16 review reports had wrongly stated that every unblinded path was package-private.

This PR implements ADR-0046 (docs/adr/0046-groth16-unblinded-proving-test-boundary.md, R3, status Proposed):

• No fixed-blinder path in the product. proveUnblindedWithReaders, the unused heap-only proveUnblinded, and the private proveInternal are removed from Groth16ProverBLS381; the dead BN254 Groth16Prover.proveUnblinded goes too. The only seam through which a test can fix (r, s) is the package-private BlinderSource of proveBlinded, introduced by ADR-0045 for the forced-infinity tests.
• Deterministic proving is an unpublished test fixture. Groth16UnblindedTestProver (new zeroj-crypto java-test-fixtures source set, same package) runs the public computeH and feeds (0, 0) exactly once through that seam, throwing on the second draw so the ADR-0045 P2 fail-closed behaviour is preserved. Both test-fixtures variants are skipped from the published component; a GenerateModuleMetadata guard (also run by check) and the ADR-0044 verifyDefaultModuleSurface task fail on a re-published variant or a runtime test-fixtures edge.
• API-surface regression test. Groth16ProverApiSurfaceTest pins the exact public method sets of Groth16ProverBLS381, Groth16Keys, Groth16Pipeline, Groth16Prover and every public proof-returning method across the groth16/plonk packages (20), scans both packages for fixed-blinder names or BlinderSource parameters, asserts the fixture loads from a different code source than the prover, and checks behaviourally, against an independently computed unblinded A/B, that all eleven public BLS12-381 prove paths (and the BN254 pair) are blinded and randomized while the fixture is deterministic and still pairing-verifies.
• Differential tests keep their oracle. The eight byte-equality gates (heap/mmap, dense/sparse store, pure-Java/blst, serial/parallel) use the fixture; expected values are bit-identical.
• Docs. ADR-0046; ADR-0036 and ADR-0045 cross-references; Groth16 dev guide states that unblinded proofs are not zero-knowledge and that no public path exists; zeroj-crypto README; README ADR list.

Acceptance criteria (#50)

• Normal public Groth16 APIs cannot create an unblinded proof accidentally (no fixed-blinder path in main; Z1–Z3).
• Differential tests retain a supported deterministic path without widening the production API (unpublished test fixture).
• API-surface/reflection test prevents an unblinded method from returning to the normal public facade (Groth16ProverApiSurfaceTest, 8 tests).
• Documentation states that deterministic unblinded proofs do not provide the normal zero-knowledge guarantee (ADR-0046, prover Javadoc, fixture Javadoc, dev guide, README).
• Pure-Java, mmap-reader, and blst differential tests continue to pass.

Verification

Gate	Result
./gradlew build verifyDefaultModuleSurface publishToMavenLocal -PskipSigning=true	4076 tests / 19 modules / 0 failures
:zeroj-crypto:test, :zeroj-crypto-blst:test	1102 / 10 tests, 0 failures (8 differential gates re-run)
Published zeroj-crypto module metadata / POM / jar	only apiElements, runtimeElements, javadocElements, sourcesElements; no -test-fixtures jar; no fixture class or fixed-blinder method in the jar
Metadata guard, skip() lines temporarily removed	fails as intended
Module-surface guard, blst edge temporarily implementation testFixtures(...)	fails as intended
zeroj-usecases (identity-kyc, personhood-airdrop, selective-disclosure, nft-ownership, private-voting, proof-of-reserves, digital-product-passport, account-ownership:cli) against 0.1.0-pre12-<sha>-SNAPSHOT	36 tests, 0 failures; DevKit / aor.e2e / circuit.measure gated tests skipped; external snarkjs ZkeyImportIT passed

An independent high-effort code review of the diff returned ten findings; they drove the seam consolidation (no r = s = 0 code in main), the proof-producer allowlist, the wider behavioural coverage, the module-surface extension, and the ADR wording corrections (Z2 now names the package-private PlonK proveUnblinded seams as out of scope under C-04; the ADR-0036 ingress list no longer credits proveWithHCoeffs with relation validation).

Remaining assumptions / for reviewer attention

• SecureRandom is a CSPRNG on the deployment platform; blinder uniformity is argued (64 bytes reduced mod r), not measured.
• The fixture and the prover form a split package on the class path (ZeroJ has no module-info); adopting JPMS would need a redesign, recorded in the ADR.
• BN254 legacy proofs are checked for distinctness across calls only; PlonK blinding completeness stays under C-04.
• Please read secureRandomBlinders / randomScalar / proveBlinded directly rather than relying on the tests alone, and agree the maintenance policy for the two allowlists (every new public prove method needs a deliberate update).
• Source-incompatible removal of proveUnblindedWithReaders; no consumer in zeroj-usecases, zeroj-tools, or zeroj-integration-tests.

🤖 Generated with Claude Code