chore: add a regeneration flow for the genesis constants

[spalladino]

Stacked on #25497 — review that one first; this PR's diff is only the two commits on top.

Answers the review comment on #25497: "Is there a signposted automated regeneration flow that a person/ai can do to easily update them? I wonder if a git commit hook might be useful to warn people about this."

The problem

The genesis nullifier tree is seeded with the protocol contracts' registration nullifiers, which derive from their class ids. Anything that rotates a class id — a protocol contract change, a compiler bump, a transpiler change — moves the genesis roots, and several tracked files record them. Before this PR that was five hand-pinned locations, one of them inside the labs patch series, discoverable only via a late CI failure.

Reduce the pins first, then automate

Rather than automate the rewriting of five duplicated literals, most of them are removed:

• New GENESIS_NULLIFIER_TREE_ROOT in constants.nr. The existing codegen already projects it into aztec_constants.hpp, ConstantsGen.sol and constants.gen.ts, so the Noir, C++ and TypeScript genesis tests now all read one constant instead of repeating the literal.
• The six seed nullifiers move out of world_state.test.cpp into a generated genesis_protocol_nullifiers.hpp.

Two hand-pinned locations remain (constants.nr and that header), and none inside labs/ — which matters, because a file inside the patch series cannot be rewritten by a script that "never commits": persisting a labs edit requires a commit plus bootstrap.sh export.

The regeneration flow

noir-projects/fnd/scripts/regenerate_genesis_constants.sh --fixtures

Single source of truth, modelled on noir/scripts/bump_noir_compiler.sh. Phases: preflight → measure → validate → update → regenerate consumers → verify → stage. It does not commit.

flag	effect
(none)	rewrites the constants and the seed header; reports the L1 fixtures as outstanding
--fixtures	also regenerates the six L1 checkpoint fixtures (needs anvil)
--check	measures and compares only, writes nothing, non-zero exit if stale

Three deliberate design points, all from review:

• Fail-fast, not best-effort. The Noir bump script degrades gracefully because a partial bump still leaves a useful diff. Here a half-applied regeneration leaves constants that disagree with each other, so a missing dependency, a failed measurement or a replacement that did not match is a hard error. A replacement must match its named declaration exactly once.
• It rebuilds constants-codegen before the remake scripts. Those read the inputs embedded when the package was built, so running them against an edited constants.nr without rebuilding will cheerfully reproduce the previous values and report success. This bit me during development.
• It refuses to run against a build older than the protocol contract sources, rather than measuring stale artifacts.

aztec compute-genesis-values now also reports the canonical measurement, through the same shared measureCanonicalGenesis helper the script reads, so there is one computation rather than two that can drift.

Precommit reminder

Fires when staged changes touch the protocol contract sources, the Noir submodule pin or the transpiler. It names the regeneration command and never blocks.

It is explicitly a reminder, not evidence of freshness — deciding whether a class id actually moved means compiling the contracts and computing the ids, far too slow for a hook, so the path predicate is a cheap and deliberately incomplete proxy (a shared library the contracts pull in can move an id without tripping it). It also does not go quiet merely because constants.nr is staged: only a staged edit to the GENESIS_ declarations themselves counts as handled.

What it deliberately does not touch

mainnet_compatibility.test.ts and testnet_compatibility.test.ts pin what a live network was actually deployed with. A class id rotation fails those too, and that is correct — they change only at a governance upgrade. The script never rewrites them, and both the skill and the CLAUDE.md block say so explicitly, because the tempting "fix" is to paste in the new values, which silently claims the deployed network moved.

Signposting

.claude/skills/genesis-constants/ plus a <genesis_constants> block in the root CLAUDE.md, mirroring how bump_noir_compiler.sh is surfaced through noir-sync-update.

Validation

• --check against the current tree: measures independently and confirms all three constants, the seed header and the fixtures agree.
• Red/green on the write path: corrupted GENESIS_ARCHIVE_ROOT → --check exits 1 naming the stale constant → a plain run restores it and regenerates the derived outputs. The verify phase caught a real bug in its own Solidity check (grouped digits) during that run.
• Precommit reminder: fires on a staged protocol contract edit, silent once the GENESIS_ constants are staged too.
• nargo test --package types hash_of_genesis — 1 passed.
• world_state_tests --gtest_filter='*GetInitialTreeInfo*' — 3 passed.
• stdlib/src/block/l2_block.test.ts (3), world-state/src/testing.test.ts (7), protocol-contracts/src/genesis_data.test.ts (2) — passed.
• labs-patches/bootstrap.sh check — clean. Patch 0009 is unchanged; the labs changes here are a new 0010.

Relates to A-1264.