Re-vendor spec/: half of it is stale and four implemented tables have no spec

[jotabulacios]

The vendored spec/ was last synced on 2026-06-08 (bc121383, "Update spec (#613)"). Two months of upstream changes are missing, and the gap is not cosmetic.

Measured against origin/spec/main of the spec repo (tip d397668a, 2026-07-31):

• 14 files missing entirely (77 vendored vs 91 upstream), nothing extra on our side.
• 40 of the 77 shared files differ.

The missing files

ecsm.typ  src/ecsm.toml  src/ecdas.toml        <- ECSM / ECDAS, both implemented
src/l2g.toml                                    <- local_to_global.rs
src/reg_read.toml  src/reg_write.toml  reg.typ  <- register.rs
src/sub.toml  src/fext_{fma,load,zero}.toml     <- not implemented yet
fext.typ  limbs_and_carries.typ  streaming.typ

So four tables we ship — ECSM, ECDAS, L2G and REG — have no spec in this repo at all. prover/src/tables/ecsm.rs:9 cites spec/src/ecsm.toml, which does not exist here; the file has existed upstream since 2026-06-12 and landed in the spec's main on 2026-07-20 (c75966ee, "spec: ECSM (#655)").

The stale files

Largest diffs, in changed lines:

371  tooling/chip.py       50  src/cpu.toml         32  src/halt.toml
125  src.typ               48  book.typ             30  src/keccak_round.toml
 71  chip.typ              44  src/memw.toml        26  src/page.toml
 66  src/signatures.toml   38  src/memw_aligned.toml
 62  src/commit.toml       37  memory.typ
 60  src/cpu32.toml        36  src/config.toml

src/memw.toml and src/cpu.toml are load-bearing for anything touching memory addressing.

Why it matters

#902 and #907 both come out of an ECSM implementation that stopped tracking its spec. The spec had the right constraints from 2026-06-19 onwards and nobody could see it from inside this repo, because the copy here predates the file existing. Any future work on ECSM, ECDAS, L2G or REG has the same blind spot today.

Suggested scope

Sync spec/ to a named upstream commit and record which commit, so the next drift is measurable. Worth deciding at the same time whether this stays a manual copy or becomes a submodule / pinned fetch — a manual copy is what let it drift two months without anyone noticing.