build: disable x86_64 assembly by default on Clang #1945

On x86_64, modern Clang versions generate significantly faster 64-bit scalar multiplication without inline assembly. With assembly enabled, Clang incurs a 20-30% performance penalty on scalar_mul due to callee-saved register pressure (forcing 5 push/pop pairs for %rbx and %r12-%r15) and serialized mulq carry propagation. In contrast, Clang's C codegen compiles native unsigned __int128 operations with compiler-scheduled register allocation and memory operands.

Change the default AUTO assembly selection in both CMake and Autotools to OFF when the compiler is Clang on x86_64. Explicit selection (-DSECP256K1_ASM=x86_64 or --with-asm=x86_64) remains supported. GCC retains its existing x86_64 assembly default.

Fixes #1682.

Benchmarks (bench_internal mul)

Tested on x86_64 Linux with Clang 21.1.8 and GCC 15.2.0:

In this local GCC 15.2.0 run, OFF has a lower recorded average than AUTO (0.0515 vs 0.0604 µs). The wide ranges do not support a general GCC performance claim; this PR leaves the GCC default unchanged.

Clang default scalar_mul improves by ~19-23%.

Verification

• CMake configuration verified:
  • Clang defaults to assembly: OFF
  • GCC defaults to assembly: x86_64
  • Clang with -DSECP256K1_ASM=x86_64 forces assembly: x86_64
• Autotools configuration verified:
  • Clang defaults to asm = no
  • GCC defaults to asm = x86_64
  • Clang with --with-asm=x86_64 forces asm = x86_64
• Full test suite (tests) passes with 0 failures under the Clang default build.
• Constant-time verification (ctime_tests under Valgrind 3.26.0) passes with 0 errors.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

GCC continues to use x86_64 assembly by default where it remains beneficial.

Doesn't your table show what OFF is also faster for GCC (15.2.0)?

You're right. In my GCC 15.2.0 run, OFF has the lower average (0.0515 vs 0.0604 µs). The ranges are wide, so that table doesn't support my claim that assembly is beneficial for GCC. I've corrected the PR description. The code change here only affects Clang's AUTO selection; GCC's default stays as it was.