feat: avoid branch condition negations in ValueMerger

[TomAFrench]

Description

Problem*

Resolves

Summary*

This PR modifies how we merge values from pred * a + (1-pred) * b to a + pred * (b-a) which avoids another multiplication. This is being done manually in here so it's worth considering as the default merger strategy.

Additional Context

Documentation*

Check one:

• No documentation needed.
• Documentation included in this PR.
• [For Experimental Features] Documentation to be submitted in a separate PR.

PR Checklist*

• I have tested the changes locally.
• I have formatted the changes with Prettier and/or cargo fmt on default settings.

[github-actions]

Changes to Brillig bytecode sizes

Generated at commit: 711536fd584b26707a48f41dff497392c9b9b46b, compared to commit: 19eef30cdbd8a3a4671aabbbe66b5481a5dec3f7

There are no changes in circuit sizes

[github-actions]

Changes to circuit sizes

Generated at commit: 711536fd584b26707a48f41dff497392c9b9b46b, compared to commit: 19eef30cdbd8a3a4671aabbbe66b5481a5dec3f7

🧾 Summary (10% most significant diffs)

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
sha256_regression	+64,111 ❌	+159.40%	+58,326 ❌	+28.08%
sha256_var_size_regression	+1,290 ❌	+6.43%	-8,839 ✅	-11.54%
hashmap	-29,425 ✅	-31.45%	-30,399 ✅	-20.13%
debug_logs	-6 ✅	-13.04%	-52 ✅	-85.25%

---

Full diff report 👇

Program	ACIR opcodes (+/-)	%	Circuit size (+/-)	%
sha256_regression	104,332 (+64,111)	+159.40%	266,076 (+58,326)	+28.08%
array_sort	59 (+6)	+11.32%	120 (+6)	+5.26%
eddsa	71,308 (+1,014)	+1.44%	71,420 (+1,014)	+1.44%
bench_eddsa_poseidon	18,177 (+255)	+1.42%	21,004 (+255)	+1.23%
binary_operator_overloading	567 (+4)	+0.71%	8,214 (0)	0.00%
conditional_1	3,535 (-711)	-16.75%	38,799 (0)	0.00%
conditional_regression_short_circuit	94 (-4)	-4.08%	38,799 (0)	0.00%
pedersen_check	41 (+3)	+7.89%	28,858 (0)	0.00%
pedersen_commitment	12 (+1)	+9.09%	28,742 (0)	0.00%
schnorr	641 (+89)	+16.12%	54,388 (0)	0.00%
sha256	3,022 (+86)	+2.93%	47,628 (0)	0.00%
sha256_var_witness_const_regression	2,619 (+86)	+3.40%	44,720 (0)	0.00%
simple_shield	52 (+3)	+6.12%	29,032 (0)	0.00%
strings	39 (+1)	+2.63%	14,373 (0)	0.00%
bigint	634 (-4)	-0.63%	7,611 (-3)	-0.04%
array_dynamic	104 (-3)	-2.80%	3,682 (-4)	-0.11%
conditional_2	19 (-3)	-13.64%	2,763 (-4)	-0.14%
regression_3607	40 (-3)	-6.98%	2,783 (-6)	-0.22%
array_if_cond_simple	105 (-6)	-5.41%	3,103 (-7)	-0.23%
conditional_regression_661	25 (-5)	-16.67%	2,775 (-7)	-0.25%
regression_mem_op_predicate	51 (-7)	-12.07%	3,554 (-9)	-0.25%
u128	764 (-18)	-2.30%	4,684 (-22)	-0.47%
regression	129 (-29)	-18.35%	3,638 (-33)	-0.90%
slice_dynamic_index	1,097 (-103)	-8.58%	6,304 (-116)	-1.81%
slices	223 (-88)	-28.30%	3,200 (-180)	-5.33%
regression_5252	72,255 (-4,743)	-6.16%	78,291 (-5,571)	-6.64%
sha256_var_size_regression	21,348 (+1,290)	+6.43%	67,748 (-8,839)	-11.54%
hashmap	64,149 (-29,425)	-31.45%	120,601 (-30,399)	-20.13%
debug_logs	40 (-6)	-13.04%	9 (-52)	-85.25%

[TomAFrench]

@guipublic This could be something interesting to take up. I'm not able to devote proper time to it atm but it looks very promising in terms of gate count reductions. I'm not sure why the sha256_regression test has regressed though.