Fix SW witness subgroup check

[okrame]

Summary

• enforce the scalar-order relation in the fallback subgroup check instead of a tautological self-equality
• add a BLS12-377 G2 regression test covering both subgroup and non-subgroup witnesses

Why

The fallback path computes (r - 1) * ge, but previously enforced ge == ge. Enforcing -ge == (r - 1) * ge instead proves r * ge == 0, so witness allocation rejects points outside the prime-order subgroup.

Closes #199.

Testing

• cargo fmt --all -- --check
• cargo test test_bls12_377_g2_witness_subgroup_check --lib