fix(ram): keep dynamic init witness padding zero

[hero78119]

Problem

Dynamic RAM init could write non-zero values into committed witness padding rows. That violates the expected zero-padding invariant for RMM witness commitments and causes CPU shard verification to fail with InvalidPcsOpen.

Design Rationale

Keep the existing padded CPU proving flow and add the missing dynamic-init guard so only real instances populate committed witness rows. This preserves the RMM zero-padding contract without changing verifier logic.

Related: scroll-tech/gkr-backend#62

Change Highlights

• ceno_zkvm: guard dynamic RAM init witness writes with i < num_instances so padded witness rows remain zero.
• No verifier changes.

Benchmark / Performance Impact

Operation

CPU benchmark: block 23587691, shard 0, CENO_MAX_CELL_PER_SHARD=805306368.

Operation	baseline	this PR (s)	Improve (before -> this PR)
reth-block	135	124	8.1%
app.prove	134	123	8.2%
app.verify	0.300	0.288	4.0%

Layer

Layer	before: no guard + remote gkr (s)	this PR (s)	Improve (before -> this PR)
create_proof_of_shard	130	119	8.5%
commit_traces	17.2	10.3	40.1%
prove_batched_main_constraints	32.4	32.0	1.2%
pcs_opening	36.8	33.9	7.9%

Benchmark command(s):

CENO_MAX_CELL_PER_SHARD=805306368 \
OUTPUT_PATH=metrics_23587691_shard0_cpu_dynamic_guard_no_gkrzero_maxcell805306368_20260608.json \
RUST_LOG=info \
target/release/ceno-reth-benchmark-bin \
  --block-number 23587691 \
  --chain-id 1 \
  --cache-dir block_data \
  --mode prove-app \
  --app-proofs ./app_proof.bitcode \
  --shard-id 0

Baseline used the same benchmark with Ceno patched to 902b3e3c^ (7d8086c2) and remote gkr-backend tag v1.0.0-alpha.31.

Environment (CPU/GPU, core count, rust toolchain, commit hash):

• CPU shard run, rustc 1.93.0-nightly (07bdbaedc 2025-11-19)
• before: Ceno 7d8086c2, remote gkr-backend v1.0.0-alpha.31
• this PR: Ceno 902b3e3c

raw data:

• before: sanity_23587691_shard0_cpu_fresh_baseline_remote_gkr_no_guard_maxcell805306368_20260608.log, failed verification with InvalidPcsOpen
• this PR: sanity_23587691_shard0_cpu_dynamic_guard_no_gkrzero_maxcell805306368_20260608.log, passed verification

Testing

cargo check --package ceno_zkvm
CENO_MAX_CELL_PER_SHARD=805306368 target/release/ceno-reth-benchmark-bin --block-number 23587691 --chain-id 1 --cache-dir block_data --mode prove-app --app-proofs ./app_proof.bitcode --shard-id 0

Risks and Rollout

Low risk: the change only skips dynamic RAM init writes for rows outside num_instances. Rollback is reverting this guard.

Follow-ups (optional)

None.

Copilot Reviewer Directive (keep this section)

When Copilot reviews this PR, apply .github/copilot-instructions.md strictly.