[odraccir1]

Half-GCD currently pays FFT and CRT overhead for scalar/linear polynomial products and repeatedly transforms operands during matrix updates. This PR reduces that overhead in the BN254 small-prime FFT backend.

• Route scalar and linear operands through existing schoolbook arithmetic.
• Share input conversions and forward transforms across matrix–matrix and matrix–pair products.
• Accumulate each sum of two products before inverse transforms and CRT reconstruction.
• Preserve exact coefficient bounds, output aliasing, and ordinary multiplication fallbacks. Shared input spectra have a configurable 256 MiB budget; exceeding it declines fusion without changing outputs.

Single-core x86 benchmarks show 1.80–1.86× faster execution than the existing half-GCD implementation across degrees 512–8192, using identical cutoffs and three timed trials after one warmup.

Validation on saved degree-14,938 operands also measures the cumulative improvement over classical GCD:

Operation: Original classical GCD, Optimized half-GCD, Speedup
Square-free check: gcd(H, H′): 340.63 s , 18.15 s, 18.76×
Frobenius screening GCD: 344.20 s , 18.20 s, 18.91×

These cumulative gains include enabling half-GCD. Measurements used AMD EPYC 9454, GCC 15.2, identical compiler flags, and one pinned CPU. Each saved-input configuration had one timed trial without warmup. Process peak RSS increased from approximately 77 MiB to 284 MiB.

Half-GCD remains opt-in. The measured configuration uses gcd_half_gcd_cutoff = 128 and half_gcd_basecase_cutoff = 60, selected by the caller. These measurements validate GCD performance on the tested operands; full AADP workflow performance remains unmeasured.