review guest program error bypass application constrain `commit`

Refer lambdaclass research https://blog.lambdaclass.com/responsible-disclosure-of-an-exploit-in-succincts-sp1-zkvm-found-in-partnership-with-3mi-labs-and-aligned-which-arises-from-the-interaction-of-two-distinct-security-vulnerabilities/

ceno::commit (from #881) are kind of application side constrain and only check when pc navigate through this call. However a malicious prover might be able to bypass the control flow by carefully early terminating the program e.g. panic thus the public io constrain was entirely skip. We need to review carefully on how sdk deal with error handling

Start with the ceno::commit behavior introduced in #881 and read the linked LambdaClass disclosure for the early-termination scenario. Review the SDK's error-handling path, especially panic or other abnormal program exits, and determine how public I/O constraints are handled when control flow does not reach ceno::commit. Done means the review identifies and addresses any way a malicious prover can bypass those constraints.