fix(bn254): drop subgroup check from V0 G2 addition

[valentynkit]

Intent

Fixes #1713.

ALT_BN128_G2_ADD must accept any on-curve G2 point; the prime-order subgroup check is not part of V0 addition. Sig decodes both add operands through the subgroup-checking G2.fromBytes, so an on-curve point outside the order-r subgroup returns r0 = 1 (error) on Sig while Agave and Firedancer return r0 = 0 with the point. A program can branch on r0 or store the output, so the same syscall forks execution and committed account state. enable_alt_bn128_g2_syscalls (SIMD-0302) is active on all clusters, so this is reachable on mainnet today.

Implementation

• Split the G2 decode checks: isWellFormed becomes isOnCurve (curve equation) and isInSubgroup (order-r membership), composed in fromBytes behind a Validate flag. addSyscall passes .curve_only; mulSyscall and pairingSyscall pass .curve_and_subgroup and keep their current behavior.
• Matches both oracles, which gate G2 add the same way: Agave into_affine_unchecked (curve-only) vs the subgroup-checking TryFrom<PodG2>, and Firedancer g2_frombytes_check_eq_only vs _check_subgroup.
• G1 is untouched (cofactor 1, no subgroup check). G2/G1 subtraction is unimplemented, so addition is the only affected path. The add path has routed through the subgroup-checking G2.fromBytes since vm: implement LE & G2 alt_bn128  #1226.

Ramifications

• V0 G2 addition now adds and returns on-curve non-subgroup operands instead of rejecting them, matching Agave and Firedancer.
• Multiplication and pairing still run the subgroup check, so nothing that depends on subgroup membership is weakened.

Tests

• Added test "G2 addition accepts on-curve non-subgroup point": addSyscall(P, infinity) returns P, while mulSyscall(P, 1) still errors NotWellFormed. P is the on-curve non-subgroup point that test "edge cases" already rejects via pairingSyscall.
• A/B verified: the test fails at the subgroup check without this change and passes with it. add/mul/pairing/edge cases stay green.