f5f71220a7
Replace mul_shift384's inline product computation with the proven mul_wide function, eliminating the row-based carry accumulation overflow bug (t[i+4] = carry overwrites instead of adding). Traced the remaining scalar_mul reduction bug to its exact location: products of two ~256-bit scalars lose exactly NC[1] = 0x4551231950B75FC4 in the second fold step. The mul_wide product and first fold are correct, but the second fold (handling sum[4..7]) loses a carry at limb position 2. https://claude.ai/code/session_011KVZhDcV2G7idNWEBz12GY