feat: declare B_generator as the group generator

sigma-proofs reserves element index 0 of every instance for
`G::generator()`, which it validates but never serializes. `B_generator`
*is* `G::generator()` (`CMZBasepoints::init` sets it so), but it was
allocated an ordinary element, so every relation cmz emits paid a point
compression and 32 bytes of instance encoding for it -- on every prove
and every verify, while the reserved slot sat unused.

Declare it `generator` and it lands on index 0 instead. It keeps `cind`:
the range-proof transform takes the first two `cind` points, sorted, as
its Pedersen bases, and those are `A_generator` and `B_generator`.

It stays an `Instance` field, deliberately. The generated code still
assigns it, and `LinearRelation::set_element` rejects an assignment that
conflicts with the generator already at index 0 -- so if `B_generator`
ever stops being the generator, it fails loudly instead of silently
proving a different statement.

Requires the `generator` tag from sigma-compiler, and changes the encoded
instance, hence the challenge: prover and verifier must be upgraded
together.

cmz-core/src/lib.rs

@@ -394,6 +394,12 @@ pub fn cmz_core(
 
     let A_ident = format_ident!("A_generator");
     let B_ident = format_ident!("B_generator");
+    // `B_generator` is `G::generator()`, which sigma-proofs keeps at instance
+    // index 0 and never serializes, so it is declared `generator` rather than
+    // allocated an element of its own. Held apart from the other const points
+    // only because it carries that extra tag.
+    let mut cli_proof_generator_points: Vec<Ident> = Vec::new();
+    let mut iss_proof_generator_points: Vec<Ident> = Vec::new();
     let d_ident = format_ident!("d_privkey");
     let D_ident = format_ident!("D_pubkey");
     let iss_proof_sessid_ident = format_ident!("iss_proof_sessid");
@@ -425,7 +431,7 @@ pub fn cmz_core(
             #finalize_code
             let #B_ident = bp.B();
         };
-        iss_proof_const_points.push(B_ident.clone());
+        iss_proof_generator_points.push(B_ident.clone());
     }
 
     // Stash the issue proof session id in prepare so that it can be
@@ -1030,6 +1036,7 @@ pub fn cmz_core(
         reply_fields.push_bytevec(&iss_proof_ident);
         let iss_instance_fields = iss_proof_pub_points
             .iter()
+            .chain(iss_proof_generator_points.iter())
             .chain(iss_proof_const_points.iter())
             .chain(iss_proof_pub_scalars.iter());
         let iss_witness_fields = iss_proof_rand_scalars
@@ -1050,6 +1057,7 @@ pub fn cmz_core(
         };
         let cli_iss_instance_fields = iss_proof_pub_points
             .iter()
+            .chain(iss_proof_generator_points.iter())
             .chain(iss_proof_const_points.iter())
             .chain(iss_proof_pub_scalars.iter());
         finalize_code = quote! {
@@ -1284,7 +1292,7 @@ pub fn cmz_core(
         }
     }
     cli_proof_const_points.push(A_ident.clone());
-    cli_proof_const_points.push(B_ident.clone());
+    cli_proof_generator_points.push(B_ident.clone());
 
     for paramid in proto_spec.params.iter() {
         let scoped_param = format_ident!("param_{}", paramid);
@@ -1319,6 +1327,7 @@ pub fn cmz_core(
     request_fields.push_bytevec(&cli_proof_ident);
     let cli_instance_fields = cli_proof_pub_points
         .iter()
+        .chain(cli_proof_generator_points.iter())
         .chain(cli_proof_const_points.iter())
         .chain(cli_proof_cind_points.iter())
         .chain(cli_proof_pub_scalars.iter());
@@ -1339,6 +1348,7 @@ pub fn cmz_core(
     };
     let iss_cli_instance_fields = cli_proof_pub_points
         .iter()
+        .chain(cli_proof_generator_points.iter())
         .chain(cli_proof_const_points.iter())
         .chain(cli_proof_cind_points.iter())
         .chain(cli_proof_pub_scalars.iter());
@@ -1559,6 +1569,7 @@ pub fn cmz_core(
                  #(pub #cli_proof_pub_scalars,)*),
                 (#(cind #cli_proof_cind_points,)*
                  #(#cli_proof_pub_points,)*
+                 #(generator cind const #cli_proof_generator_points,)*
                  #(cind const #cli_proof_const_points,)*),
                 #(#cli_proof_scoped_statements,)*
                 #(#cli_proof_statements)*
@@ -1583,6 +1594,7 @@ pub fn cmz_core(
                  #(pub #iss_proof_pub_scalars,)*),
                 // no cind_points
                 (#(#iss_proof_pub_points,)*
+                 #(generator cind const #iss_proof_generator_points,)*
                  #(cind const #iss_proof_const_points,)*),
                 #(#iss_proof_statements)*
             }