perf: reduce Nat.powMod kernel replay cost

Nat.powMod from #13490 uses GMP at runtime, but kernel reduction follows its Lean definition. Certificate replay can benefit substantially from the accumulator loop used by Bhavik Mehta's powModK in PrimeCert: explicit Nat.rec/Bool.rec, fuel e + 1, and repeated halving of the exponent.

For Nat.powMod 2 (2^255 - 20) (2^255 - 19), four adjacent AB/BA comparisons on one pinned shared-host CPU give a median 7.35 ms for the current well-founded definition versus 1.59 ms for the accumulator definition. These are fresh Lean.Kernel.check calls on an equality proof in an already loaded environment, excluding startup, input elaboration, and native calculation of the expected result. The same 31–1024-bit sweep gives roughly 4–5× speedups. Every completed sample is retained.

The proposed change preserves the GMP extern, powMod_def, the public API, and powMod b e 0 = b ^ e. A fuel invariant proves correctness for arbitrary inputs, including modulus zero. Added coverage includes exhaustive small inputs, non-coprime bases, zero/one at huge exponents, and Curve25519 kernel replay.

This follows the primality-certificate measurements in https://github.com/kim-em/hex-dev/pull/10275. Feedback on bringing this kernel representation into Nat.powMod is welcome; an implementation with a correctness proof and benchmark is ready.

Prepared with Codex assistance.

Start with Nat.powMod, its powMod_def theorem, and the accumulator loop used by powModK in PrimeCert. Check the proposed representation with Lean.Kernel.check and the stated small-input, non-coprime, huge-exponent, and Curve25519 coverage. Done means preserving the GMP extern and public API, proving correctness for arbitrary inputs including modulus zero, and reproducing a benchmark improvement.