`NoteValue - NoteValue` is always guaranteed to produce a valid
`ValueSum`, so we make that infallible and introduce a new helper method
`ValueSum::magnitude_sign` that we use for circuit synthesis.
The `Bundle` struct is variable in size and requires allocations, but
`Action` is not. This split will make it cleaner to disable the bundle
logic for no-std support.
The change to the pinned circuit description is due to removing the
unnecessary `selector_map` pin in zcash/halo2#521. This invalidates
previous proofs due to changing Fiat-Shamir transcript initialization).
Use derived equality and ordering (which delegate to constant-time
versions) for note::nullifier::Nullifier and tree::MerkleHashOrchard
so that these types can be used as map keys in wallets.
The MSRV is now 1.54.0, because reddsa 0.2.0 included a fix to its
nightly CI that inadvertently bumped its MSRV.
The `halo2` crate is now the `halo2_proofs` crate, but we're avoiding
the cross-repo crate rename until after `halo2_gadgets` is extracted.
This also brings in the 20% prover performance improvement from
zcash/halo2#447.
There is no reason for crate users to be constructing `ValueSum`
directly. We no longer use it to represent `valueBalanceOrchard`,
instead requiring the user to specify their own type.