prefractal: document the deviations and add the constant-time test

doc/prefractal.md writes down the three deliberate deviations from BIP 445
where a reviewer will find them, since none of them is visible from the API
and two of them are actively counterintuitive:

1. b_frost does not commit to the message, because the target protocols
   publish the group's wire nonce before the message exists. The outer b_musig
   does commit to it and multiplies b_frost everywhere it appears.

2. There is no g_frost factor, and the reason is NOT that the tweak cache is
   the identity. The frost key-side factor is g*gacc; an identity cache gives
   gacc = 1, but g is still -1 for every odd-Y threshold key. The doc spells
   this out because "identity cache, therefore no key term" is the plausible
   wrong reason, and acting on it yields a signer that works for even-Y groups
   and fails for odd-Y ones.

3. The frost tweak cache must be the identity, checked at signing and
   verification and not only at aggregation, so the key a member signs under
   is tied to the cache that was validated.

It also records the two caller obligations the module cannot enforce - one
secnonce per signature, and round-two signers EQUAL to round-one contributors
- and notes that iceberg tolerates a round-two subset where this module must
not, since callers moving between the two would otherwise transpose the rule.

The build section documents the three-way ordering constraint rather than
leaving the next person to copy iceberg's positions, which are wrong for
configure.ac.

The ctime test adds a 2-of-2 nested group with a stock musig cosigner, taken
as far as one signature share, marking the threshold key, the secret shares
and the session randomness as secret and everything else as public. Nonce
generation passes msg = NULL, which is how the module is actually driven.

Verified: valgrind -q ./build/bin/ctime_tests exits 0, so nothing in the
prefractal signing path branches on secret data. Full test suite green.

The example program from the plan's optional list is not included; the test
suite covers the same ground and the doc carries the usage rules.

src/ctime_tests.c

@@ -61,6 +61,10 @@
 #include "../include/secp256k1_chilldkg.h"
 #endif
 
+#ifdef ENABLE_MODULE_PREFRACTAL
+#include "../include/secp256k1_prefractal.h"
+#endif
+
 #ifdef ENABLE_MODULE_ICEBERG
 #include "../include/secp256k1_iceberg.h"
 #include "../include/secp256k1_iceberg_dealer.h"
@@ -593,6 +597,100 @@ static void run_tests(secp256k1_context *ctx, unsigned char *key) {
     }
 #endif
 
+#ifdef ENABLE_MODULE_PREFRACTAL
+    {
+        /* A 2-of-2 nested group with one stock musig cosigner, taken as far as
+         * one signature share. Secret here is the threshold key, the secret
+         * shares derived from it, and the session randomness the nonces come
+         * from. Not secret: the identifiers, the public shares, the threshold
+         * public key, both aggregate nonces, the outer keyagg cache, b_frost,
+         * and the resulting partial signature. */
+        unsigned char thresh_seckey[32];
+        unsigned char secshares[2 * 32];
+        unsigned char session_secrand[2][32];
+        unsigned char cosigner_seckey[32];
+        secp256k1_pubkey thresh_pk, pubshares[2], cosigner_pk;
+        const secp256k1_pubkey *outer_pubkeys[2];
+        uint32_t pf_ids[2] = { 0, 1 };
+        secp256k1_frost_tweak_cache pf_cache;
+        secp256k1_frost_secnonce pf_secnonce[2];
+        secp256k1_frost_pubnonce pf_pubnonce[2];
+        const secp256k1_frost_pubnonce *pf_pubnonce_ptrs[2];
+        secp256k1_frost_aggnonce pf_aggnonce;
+        secp256k1_frost_partial_sig pf_partial_sig;
+        secp256k1_xonly_pubkey outer_xonly;
+        secp256k1_musig_keyagg_cache outer_cache;
+        secp256k1_musig_pubnonce group_pubnonce, cosigner_pubnonce;
+        const secp256k1_musig_pubnonce *just_cosigner[1];
+        secp256k1_musig_secnonce cosigner_secnonce;
+        secp256k1_musig_aggnonce cosigner_aggnonce;
+        unsigned char cosigner_secrand[32];
+
+        pf_pubnonce_ptrs[0] = &pf_pubnonce[0];
+        pf_pubnonce_ptrs[1] = &pf_pubnonce[1];
+
+        SECP256K1_CHECKMEM_DEFINE(key, 32);
+        memcpy(thresh_seckey, key, sizeof(thresh_seckey));
+        thresh_seckey[0] = thresh_seckey[0] + 4;
+        memcpy(cosigner_seckey, key, sizeof(cosigner_seckey));
+        cosigner_seckey[0] = cosigner_seckey[0] + 5;
+        memcpy(session_secrand[0], key, 32);
+        session_secrand[0][0] = session_secrand[0][0] + 6;
+        memcpy(session_secrand[1], key, 32);
+        session_secrand[1][0] = session_secrand[1][0] + 7;
+        memcpy(cosigner_secrand, key, 32);
+        cosigner_secrand[0] = cosigner_secrand[0] + 8;
+        SECP256K1_CHECKMEM_DEFINE(msg, sizeof(msg));
+
+        SECP256K1_CHECKMEM_UNDEFINE(thresh_seckey, sizeof(thresh_seckey));
+        ret = secp256k1_frost_trusted_dealer_keygen(ctx, secshares, &thresh_pk, pubshares, 2, 2, thresh_seckey);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+        SECP256K1_CHECKMEM_DEFINE(&thresh_pk, sizeof(thresh_pk));
+        SECP256K1_CHECKMEM_DEFINE(pubshares, sizeof(pubshares));
+        CHECK(secp256k1_frost_tweak_cache_init(ctx, &pf_cache, &thresh_pk) == 1);
+
+        /* The outer aggregation and the cosigner's round one are entirely
+         * public as far as this module is concerned. */
+        SECP256K1_CHECKMEM_UNDEFINE(cosigner_seckey, sizeof(cosigner_seckey));
+        ret = secp256k1_ec_pubkey_create(ctx, &cosigner_pk, cosigner_seckey);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+        SECP256K1_CHECKMEM_DEFINE(&cosigner_pk, sizeof(cosigner_pk));
+        outer_pubkeys[0] = &thresh_pk;
+        outer_pubkeys[1] = &cosigner_pk;
+        CHECK(secp256k1_musig_pubkey_agg(ctx, &outer_xonly, &outer_cache, outer_pubkeys, 2) == 1);
+
+        SECP256K1_CHECKMEM_UNDEFINE(cosigner_secrand, sizeof(cosigner_secrand));
+        ret = secp256k1_musig_nonce_gen(ctx, &cosigner_secnonce, &cosigner_pubnonce, cosigner_secrand, cosigner_seckey, &cosigner_pk, msg, &outer_cache, NULL);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+        SECP256K1_CHECKMEM_DEFINE(&cosigner_pubnonce, sizeof(cosigner_pubnonce));
+        just_cosigner[0] = &cosigner_pubnonce;
+        CHECK(secp256k1_musig_nonce_agg(ctx, &cosigner_aggnonce, just_cosigner, 1) == 1);
+
+        /* Group round one. msg is NULL: the wire nonce is published before the
+         * message is known. */
+        for (i = 0; i < 2; i++) {
+            SECP256K1_CHECKMEM_UNDEFINE(session_secrand[i], 32);
+            SECP256K1_CHECKMEM_UNDEFINE(&secshares[32 * i], 32);
+            ret = secp256k1_frost_nonce_gen(ctx, &pf_secnonce[i], &pf_pubnonce[i], session_secrand[i], &secshares[32 * i], &pubshares[i], NULL, NULL, 0, NULL, 0);
+            SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+            CHECK(ret == 1);
+            SECP256K1_CHECKMEM_DEFINE(&pf_pubnonce[i], sizeof(pf_pubnonce[i]));
+        }
+        /* Aggregation is over published nonces only, so it is public. */
+        CHECK(secp256k1_prefractal_nonce_agg(ctx, &group_pubnonce, &pf_aggnonce, pf_pubnonce_ptrs, pf_ids, 2, &thresh_pk) == 1);
+
+        /* The share and the secnonce are secret; the partial signature is the
+         * public output. */
+        ret = secp256k1_prefractal_sign(ctx, &pf_partial_sig, &pf_secnonce[0], &secshares[0], pf_ids[0], pf_ids, pubshares, 2, &pf_aggnonce, &thresh_pk, &pf_cache, &outer_cache, &cosigner_aggnonce, msg);
+        SECP256K1_CHECKMEM_DEFINE(&ret, sizeof(ret));
+        CHECK(ret == 1);
+        SECP256K1_CHECKMEM_DEFINE(&pf_partial_sig, sizeof(pf_partial_sig));
+    }
+#endif
+
 #ifdef ENABLE_MODULE_ICEBERG
     {
         /* A 3-of-5 group, dealt from `key` and taken as far as one signature