crypto: document domain-tag position and arity rule

Domain-separation tags sit in three different slots across the library, and no note states which is the rule:

• tag-first: ElGamal.secretToScalar, ForwarderPrivate._calculateParentCommitment
• tag-last: ShieldedAccessControl.computeRoleCommitment / computeNullifier / computeAccountId, ZOwnablePK._computeOwnerCommitment, every Utils.expandRandomness caller
• tag-second: ConfidentialFungibleToken._credit

Latent, not exploitable today. A tag-last derivation of the same arity has the shape of expandRandomness(seed, tag), so its tag can be supplied through the seed slot — secretToScalar moved to tag-first for exactly this reason (H-01, #818), and a module copying the ShieldedAccessControl shape for a private derivation would not know that.

Add one note, in Utils or a crypto/ conventions block, fixing the position library-wide (tag-first, matching ElGamal) plus the arity guidance. Existing call sites can migrate in their own PRs.

Inspect the Utils area and any crypto conventions block, then compare the listed call sites such as ElGamal.secretToScalar and Utils.expandRandomness callers. Add one note stating the tag-first convention and the arity guidance, without migrating existing call sites; done means the rule and its rationale are documented clearly.