Ashlar Hash Cuts R1CS Costs, Seeks Cryptanalysis

Ashlar, a new arithmetization-oriented hash, uses a Feistel chain of field squarings for R1CS-optimal degree. Squaring yields 1.0 bits per constraint, proven as a ceiling. Ashlar-3-P costs 191 R1CS constraints vs Poseidon's 243; EVM gas is 14,232 vs 18,229. It loses on Goldilocks (4.09× slower) and Plonkish. It's unaudited; author requests attacks, not use.