perf: lazy fe_mul — remove normalize from mul/sqr output (both C and Kotlin)

Remove fe_normalize/reduceSelf from the end of field multiply and
square. After reduceWide, the output is in [0, 2^256) which may
include values in [P, P+C) where C = 2^32+977. This is the same
"unreduced" range that lazy fe_add produces, and is safe because:

- mul/sqr: mulWide handles any 256-bit input via reduceWide ✓
- add: carry fold handles overflow past 2^256 ✓
- sub: P-add-back on underflow produces correct field element ✓
- neg/half: already normalize input via reduceSelf ✓
- isZero/cmp/toBytes: caller normalizes before use ✓

Native C-to-C results (x86_64, vs ACINQ):
  verifyFast: 0.95x → 0.99x (essentially tied with ACINQ!)
  sign (cached): 1.18x → 1.24x faster
  ECDH: 1.05x → 1.06x faster
  batch(200)/event: 7.2µs → 6.4µs

Kotlin JVM results (vs previous lazy-add-only):
  Kotlin numbers stable — reduceSelf in reduceWide was already
  cheap on JVM since the branch is almost never taken.

https://claude.ai/code/session_011KVZhDcV2G7idNWEBz12GY

quartz/src/main/c/secp256k1/field.c

@@ -120,7 +120,9 @@ void reduce_wide(secp256k1_fe *r, const uint64_t w[8]) {
         }
     }
 
-    fe_normalize(r);
+    /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
+     * This is safe: mul/add/sub all handle unreduced inputs.
+     * Only neg/half/isZero/cmp/toBytes need explicit normalize. */
 }
 
 void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
@@ -187,7 +189,9 @@ void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
         r->d[0] = (uint64_t)acc; carry = (uint64_t)(acc >> 64);
         if (carry) { r->d[1] += carry; if (r->d[1] < carry) { r->d[2]++; if (!r->d[2]) r->d[3]++; } }
     }
-    fe_normalize(r);
+    /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
+     * This is safe: mul/add/sub all handle unreduced inputs.
+     * Only neg/half/isZero/cmp/toBytes need explicit normalize. */
 #else
     uint64_t w[8];
     mul_wide(w, a->d, b->d);
@@ -267,7 +271,9 @@ void fe_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe *b) {
         r->d[0] = sum;
         if (sum < c_lo) { r->d[1]++; if (!r->d[1]) { r->d[2]++; if (!r->d[2]) r->d[3]++; } }
     }
-    fe_normalize(r);
+    /* No fe_normalize — lazy. Output is in [0, 2^256), possibly in [P, P+C).
+     * This is safe: mul/add/sub all handle unreduced inputs.
+     * Only neg/half/isZero/cmp/toBytes need explicit normalize. */
 }
 
 void fe_sqr(secp256k1_fe *r, const secp256k1_fe *a) { fe_mul(r, a, a); }

quartz/src/main/c/secp256k1/field_asm.h

@@ -170,7 +170,7 @@ static inline void fe_mul_asm(secp256k1_fe *r, const secp256k1_fe *a, const secp
     );
 
     r->d[0] = r0; r->d[1] = r1; r->d[2] = r2; r->d[3] = r3;
-    fe_normalize(r);
+    /* No normalize — lazy mul. Result in [0, 2^256). */
 }
 
 #define FE_MUL_ASM 1
@@ -357,7 +357,7 @@ static inline void fe_mul_asm(secp256k1_fe *r, const secp256k1_fe *a, const secp
         : : [rp]"r"(r->d), [lo0]"r"(lo0), [lo1]"r"(lo1), [lo2]"r"(lo2), [lo3]"r"(lo3)
         : "memory"
     );
-    fe_normalize(r);
+    /* No normalize — lazy mul. Result in [0, 2^256). */
 }
 
 #define FE_MUL_ASM 1