feat: Constrain App function VKs

[sirasistant]

Resolves #9592

• Now contract artifacts must have VKs in their private functions
• aztec-nargo inserts the verification keys after public function transpilation
• We no longer derive any VK in the TX proving flow
• App VKs are now constrained in the private kernels
• Bootstrap generates VKs for all apps (with s3 caching)
• PXE is currently accepting any VK present in the artifact as valid: we should explore the correct interface for this in the future and wether PXE can use those VKs without rederiving them from ACIR

[github-actions]

Changes to circuit sizes

Generated at commit: f8ba6b6eac1aeabfd66919700ee0bf734bddbd15, compared to commit: 2509e2f132d30efa5085e9740279529ce551215a

🧾 Summary (100% most significant diffs)

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
private_kernel_init	+190 ❌	+0.88%	+3,837 ❌	+12.34%
private_kernel_inner	+189 ❌	+0.50%	+3,836 ❌	+7.14%

---

Full diff report 👇

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
private_kernel_init	21,748 (+190)	+0.88%	34,933 (+3,837)	+12.34%
private_kernel_inner	38,127 (+189)	+0.50%	57,586 (+3,836)	+7.14%

[LeilaWang]

Excellent!! 🚀

[LeilaWang]

Good catch 😂

[sirasistant]

Removing e2e-all since it's triggering a bug present on master