chore: align proving toolchain with bb 5.2.0

[Wondertan]

Motivation

The browser, compiler, and native verifier toolchains must remain one compatibility unit. This updates the release to Nargo 1.0.0-beta.25 and Barretenberg/bb.js 5.2.0, allowing the browser to pass an explicit srsSize instead of inheriting bb.js's larger generic defaults.

bb.js 5.2 uses compressed 32-byte BN254 points. Its current SrsInitSrs also requires compressed input to be a positive multiple of the 4 MiB verification chunk. Consequently the measured 42,006-gate bearer_link circuit cannot cold-start with the mathematical 2^16 ceiling: 2^16 compressed points are only 2 MiB and fail initialization. The deployable floor is 2^17. jwt_email remains 2^18.

Circuit	EVM circuit size	Deployable bb.js 5.2 SRS	Complete CRS
bearer_link	42,006	131,072 (2^17) points	8 MiB + 128 bytes
jwt_email	179,443	262,144 (2^18) points	12 MiB + 128 bytes

The complete totals include the shared 4 MiB Grumpkin data and 128-byte G2 data.

Changes

• pin Noir/Nargo to 1.0.0-beta.25 and native Barretenberg to 5.2.0;
• update noir-lang/keccak256 to v0.1.3 for beta.25;
• regenerate release artifacts with compatible compiler and backend versions.

This is stacked on #4 so its review diff contains only the toolchain bump. The published v0.3.0-rc.2 was additionally rebased onto current main, preserving the x-token rename. Consumers must deploy matching RC2 verifiers before accepting these proofs.

Verification

• all 28 Noir tests pass;
• bearer-link, jwt_email, and x-token compile and generate verification keys with native bb 5.2.0;
• the RC2 release workflow rebuilt, checksummed, and uploaded all artifact sets;
• the browser PoC proves bearer_link with 2^17 and jwt_email with 2^18 using four effective threads and shared memory.

Related follow-ups

Deeper inspection of bb.js prefetch behavior during this bump produced AztecProtocol/aztec-packages#25290. It persists compressed browser CRS data to IndexedDB immediately after download and reuses exact or larger-prefix entries. The PR is not part of the published bb.js 5.2.0; libID must consume a later build containing it before relying on Crs.new() as a navigation-durable warmup.

The release manifest still records toolchain pins and artifact hashes but not measured circuit/SRS sizes. #6 tracks deriving and publishing those values during release packaging.