MontgomeryField + refocused README Performance (close the smalljac gap)

[salindne]

Re-targets to main the two changes that were stranded after #3 merged at the f4-fix commit (so MontgomeryField and the README cleanup never reached main). Both belong together: the README cites the Montgomery numbers.

1. MontgomeryField<P> (feat)

A second Field backend behind the same trait as PrimeField: Montgomery REDC multiply (no division) + binary extended-GCD inversion, const-fn-derived constants. Drop-in for the generic divisor formulas and the batched API. Verified identical to PrimeField (10k random add/sub/mul/neg/square/inv/div at a 56-bit prime; exhaustive inversion over F₆₅₅₂₁).

2. README Performance, refocused (docs)

Replaces the stale "Apple M1" tables with, in order:

• Per operation (scalar) — not_char2 add/double, PrimeField vs MontgomeryField, with an explicit note that each affine op includes exactly one field inversion.
• Batched throughput vs smalljac — scalar + batched, MontgomeryField vs smalljac.

Result (56-bit prime, same machine, ns/op)

operation	PrimeField	MontgomeryField	smalljac
add, scalar	673	163	190
double, scalar	691	168	210
add, batched (N=1024)	348	40	48
double, batched (N=1024)	384	46	54

With MontgomeryField the genus-2 group law matches or beats smalljac in every mode; the gap was entirely the field layer (inversion 529 → 109 ns, smalljac 157; REDC multiply 8.2 → ~0.9 ns).

Checks

cargo fmt --check, cargo +stable clippy --all-targets -- -D warnings, cargo test --release (230 + doctest), cargo bench --no-run, cargo doc -D warnings all green locally.

(Supersedes the dead-end stacked #4; once this merges, the readme-perf-cleanup and batched-group-law branches can be deleted.)