Add decryption-share commitments to C6 and C7

[cedoor]

Add commitment outputs to share decryption (C6) and wire decrypted-shares aggregation (C7) to take public expected_d_commitments and check them in-circuit against witness-derived per-party commitments (same scheme / domain separator as C6). Includes Noir circuits, prover input plumbing (Inputs::compute, layouts), and commitment-consistency tests.