10a. Integrate `ECDSA` primitive — replace `stubVerifySignature`

[0xisk]

🧐 Motivation

The stateless presets (ShieldedMultiSigV2, ShieldedMultiSigToken) authorize operations by verifying ECDSA signatures on-chain, matching the format produced by EVM HSMs. Until the Compact primitive lands, the verification path is stubbed (stubVerifySignature always returns true) and the contracts cannot be deployed to production.

📝 Details

Split out of #475, which combined the ECDSA and Keccak work. The Keccak half is tracked in #827.

Scope:

• Replace stubVerifySignature with the real ecdsaVerify primitive across EcdsaSignerManager and the stateless presets.
• Confirm curve compatibility (secp256k1) with the target HSM signing infrastructure.
• Enforce the low-s form / malleability rule on accepted signatures.
• Make the stub hard-fail outside test builds so a stubbed contract cannot be deployed by accident.
• Measure real per-circuit cost (@circuitInfo k / rows) on the RC toolchain and benchmark proof time for threshold operations. This is the largest unmeasured cost term in the Monument preset feasibility analysis.

Blocked on Midnight Foundation primitive delivery (ECDSA GA). Blocks mainnet deployment of ShieldedMultiSigV2 and ShieldedMultiSigToken, and the corresponding audit scope.