feat: OP_VERIFY_ZKP opcode (Groth16 + PLONK)

[Kukks]

Summary

Implements OP_VERIFY_ZKP (0xf6, replacing the OP_UNKNOWN246 reserved slot), a polymorphic SNARK verification opcode dispatching to consensys/gnark-backed Groth16 and PLONK verifiers over BLS12-381. Tracks #77.

Stack contract

<vk> <publicInputs> <proof> <zkp_type:u8>  OP_VERIFY_ZKP

The verifying key is committed in the script body (not the witness), so the tapleaf hash binds the spend to a specific circuit. On success the opcode pushes 1; on any failure (unknown zkp_type, malformed inputs, soundness rejection) it returns a script error.

Type registry

zkp_type	System	VK size	Proof size	Verifier cost	Setup
0x01	Groth16 (BLS12-381)	~500 B	~200 B	3 pairings	per-circuit trusted
0x02	PLONK (BLS12-381 + KZG)	~1 KB	~500 B	~5 pairings	universal updatable
0x03+	reserved	—	—	—	—

Wire format for proof, vk, and publicInputs follows gnark's standard binary marshaling (WriteTo / ReadFrom). Public inputs are gnark witness.Witness bytes for the public-only witness vector.

Layout

File	Purpose
pkg/arkade/zkp/zkp.go	Verifier interface, Type enum, dispatch registry
pkg/arkade/zkp/groth16.go	Groth16 backend (gnark)
pkg/arkade/zkp/plonk.go	PLONK backend (gnark)
pkg/arkade/zkp/zkp_test.go	Verifier-level round-trip tests
pkg/arkade/op_verify_zkp.go	Opcode handler
pkg/arkade/op_verify_zkp_test.go	Handler-level round-trip tests
pkg/arkade/opcode.go	Constant OP_VERIFY_ZKP = 0xf6 + opcodeArray entry
pkg/arkade/opcode_test.go	Replaces invalidSpec(OP_UNKNOWN246) with a verifyZkpSpec() that exercises malformed-input rejection paths

Why polymorphic instead of one opcode per system

Standard Bitcoin practice would allocate distinct opcodes per system. For Arkade specifically, the introspector binary is upgraded in coordination with arkd, so extending the dispatch table is operationally feasible. One opcode covers a growing family of proof systems without further allocation pressure, and a script can accept multiple zkp_type values via runtime branching.

The dispatch overhead at verification is a single map lookup — negligible against the underlying pairing math.

Tests

All tests generate proofs in-test via gnark's prover (no precomputed fixtures), exercising the full prove → marshal → verify-via-opcode round trip on a trivial x*x == y circuit. Includes both honest-proof acceptance and tamper / wrong-input rejection.

PLONK tests use gnark/test/unsafekzg.NewSRS for the in-test KZG SRS — explicitly not suitable for production deployments, which must use a public ceremony's SRS (Aztec Ignition, Polygon Ignition, etc.).

$ go test ./pkg/arkade/...
ok  	github.com/ArkLabsHQ/introspector/pkg/arkade	0.466s
ok  	github.com/ArkLabsHQ/introspector/pkg/arkade/zkp	0.273s

Test plan

• All existing pkg/arkade tests pass with the renamed opcode constant
• OP_VERIFY_ZKP honest Groth16 proof verifies and pushes 1
• OP_VERIFY_ZKP honest PLONK proof verifies and pushes 1
• Tampered proof rejects (script error)
• Wrong public input rejects (script error)
• Unknown zkp_type rejects with ErrUnknownType wrap
• Malformed zkp_type byte (length != 1) rejects with ErrInvalidStackOperation
• Stack underflow rejects with ErrInvalidStackOperation
• go vet ./... passes
• go build ./... passes

Open follow-ups (out of scope for this PR)

• Cost accounting / weight units for SNARK verification (DoS protection)
• Public-inputs canonical encoding spec (currently gnark's binary witness format)
• Structural VK validation (currently relies on gnark's parser)
• Fuzz target for (zkp_type, proof, public_inputs, vk) triples
• Reserve future zkp_type allocations (Halo 2, Plonky2, STARK, Binius) — exceed practical witness budgets today, kept as footnote in the issue's type registry