fix: return Err on malformed proofs and out-of-range params instead of panicking

[mwaddip]

Problem

BatchAVLVerifier panics on several classes of malformed input instead of returning an error:

• empty / truncated / garbage proof bytes → slice-bounds or stack.pop().unwrap() panic during tree reconstruction
• an out-of-range (e.g. wrapped-negative) key length → slice-bounds or arithmetic-overflow panic
• an operation whose value length ≠ the tree's fixed value length → assert! panic in the modify path

The reference Scala/scorex BatchAVLVerifier wraps reconstruction in a Try and treats any failure as "no reconstructed tree", so its consumers (sigma's CErgoTreeEvaluator / CAvlTreeVerifier) never observe a panic — a failed construction yields a verifier whose operations fail and whose digest is None. Because this crate panics instead, a consumer that feeds it crafted / attacker-supplied proof bytes (e.g. sigma-rust evaluating an AvlTree operation) crashes rather than failing the operation cleanly — a crash-on-deserialize / DoS risk.

Fix

Honor the crate's existing Result / ensure! contract at the panic sites so the same inputs return Err:

• reconstruct_tree: bounds-checked proof reads via a small read_proof_slice helper (with checked_add against length overflow), a guarded loop bound, and ok_or on the stack pops.
• modify_helper: assert! → ensure! on the two value-length checks.

No behavior change for valid proofs — the new checks only fire where the code would previously have panicked. Works under no_std and is unaffected by panic = "abort".

Tests

tests/malformed_proof.rs — empty, single-garbage-byte, truncated-label, and truncated-real proofs; an oversized key length; and a wrong-length operation value. Each asserts Err rather than a panic.

Found via SANTA conformance testing of the sigma-rust port against the JVM oracle.

[mwaddip]

Consumer side: ergoplatform/sigma-rust#892 (eval-layer regression tests, Draft). These should merge together — that PR's tests exercise this fix through sigma-rust's AVL evaluator and are #[ignore]d until this releases + sigma-rust bumps the version.

[mwaddip]

Rebased onto current main (40f3ef9) — this had gone conflicting after #20 merged.

The conflict was in the LEAF_IN_PACKAGED_PROOF arm: this PR routes the reads through read_proof_slice, while #20 landed the MAX_VALUE_LENGTH cap against the pre-read_proof_slice text. The resolution keeps both — read_proof_slice for the reads, and the cap ensure! between length-decode and allocation, so an oversized declared length is rejected before anything is copied.

Still a single commit, now f2090fb. All tests pass, including the 6 malformed_proof cases here and the 4 canonical_proof_comparison cases from #17.

One overlap worth flagging: #23 (rustfmt only) wraps the same long ensure! in src/batch_avl_verifier.rs identically, since it fails cargo fmt --check on main today. Whichever merges first makes the other's hunk redundant and the second will need a trivial rebase. Otherwise independent.