[odraccir1]

Modular composition repeatedly multiplies outer coefficients by cached baby-step coefficients. This PR adds an opt-in prepared kernel that reuses operand preparation and accumulates base-field dot products before reconstructing each Fp12 result.

The full-size BN254 benchmark reduces coefficient-combination time from 330.15 s to 29.77 s, an 11.09× speedup on one x86 core.

The implementation:

• Represents Fp12 multiplication through 54 reusable base-field operand forms, with recombination performed after accumulation.
• Caches prepared baby-step coefficients and prepares each selected outer coefficient once per block evaluation.
• Processes up to four adjacent blocks together while preserving the original descending Horner order.
• Adds portable and BMI2/ADX scalar arithmetic, plus four- and eight-lane AVX-512 IFMA kernels with bounded accumulation and canonical Montgomery results.
• Retains scalar evaluation for blocks with fewer than eight nonzero nonconstant terms, unsupported fields, or insufficient preparation budget.
• Keeps prepared storage owned by the cache and scratch storage local to each composition call.

Preparation is controlled by modular_composition_prepared_byte_limit, which defaults to zero. The limit covers additional prepared coefficient storage. modular_composition_simd_lanes selects scalar prepared arithmetic (0) or four/eight SIMD lanes where supported; its default is eight. CMake checks host and compiler support before enabling IFMA.

The benchmark used an AMD EPYC 9454, GCC 15.2, degree 14,938, 122 blocks of 123 terms, one warmup and three measured trials. Headline timings come from builds without instrumentation.

Measurement, Original scalar, Prepared IFMA8
Median coefficient-combination time, 330.15 s, 29.77 s
One-time composition-cache construction, 99.34 s, 112.25 s
Peak process memory, 1.28 GiB, 4.96 GiB