Verifier check of EVM PublicValues

[wborgeaud]

Currently the verifier does not check the public values outputted by the prover.
See #988 for discussions on how to solve this.

[hratoanina]

Our idea is to use the verifier memory bus (proposed by @dlubarov) introduced in #1026 to check public values are correctly written in (or read from) memory.

The only issue we have is that while the timestamp for the reads is 0, the timestamp for the writes is cpu_trace_len, which is not known to the verifier and is lost during recursion.
Our solution is to pass this timestamp as private input to the first recursion layer, and to not have it checked by the verifier. The rationale is that the prover cannot cause harm by providing a wrong value:

• if the timestamp is too early, then the GLOBAL_METADATA_STATE_TRIE_DIGEST_AFTER & cie haven't been updated yet and are all 0.
• if the timestamp is too late, then nothing modifies the metadata after they're correctly written, and the only thing it would cause it to make the memory trace larger because of the range check.

[wborgeaud]

To avoid this issue with the timestamp for the trie roots, couldn't we write the trie roots in memory at the same time as the block metadata? And then replace

global hash_initial_tries:
    %mpt_hash_state_trie   %mstore_global_metadata(@GLOBAL_METADATA_STATE_TRIE_DIGEST_BEFORE)
    ...

with

global hash_initial_tries:
    %mpt_hash_state_trie   %mload_global_metadata(@GLOBAL_METADATA_STATE_TRIE_DIGEST_BEFORE) %assert_eq
    ...

(same with hash_final_tries)

[wborgeaud]

Done in #1026 and #1172.