pub fn montgomery_reduction_divisibility() -> boolExpand description
Certify the Montgomery DIVISIBILITY: x + (x·qinv')·q = x·169·R, i.e. the reduction’s
numerator (with the un-reduced lo = x·qinv') is an EXACT multiple of R — so redc’s
/ R is an exact shift, never a rounding division. This is what makes qinv' = 3327 the
RIGHT constant (qinv'·q ≡ −1 mod R): the kernel ring canonicalizer reduces both sides to
x·11075584, certifying it for ALL x, not a sampled width.