[finalis-core]

1. VRF verification is 7.5× faster

Verification went from 3.40 ms to 0.45 ms, beating the 1 ms target. Proving stays about 0.2 ms. No output changed, so this needs no testnet reset and no new genesis.

Changes, all in src/crypto/vrf.cpp:

• Montgomery multiplication: point coordinates stay in OpenSSL's fast Montgomery form and are converted only when encoding or decoding.
• No allocations in the hot loop: additions and doublings work in place with reusable per-thread scratch numbers (before, every addition allocated about 14 numbers).
• Dedicated doubling formula (dbl-2008-hwcd), cheaper than reusing the addition formula.
• Joint scalar multiplication (Straus/Shamir): s·B − c·Y and s·H − c·Γ each run as one shared pass.

This saves about 50 minutes of sync time per million blocks.

Verification:

• All 724 tests pass, including the RFC 9381 vectors.
• The cross-libsodium proof is unchanged: it's byte-identical (9ceb68c1…) here and in the CI image with old libsodium.
• The startup self-test passes in both environments.
• No sanitizer findings: ASan and UBSan report nothing under the old libsodium.

2. The flaky follower-sync test is fixed