P-256's fixed-base table for crypto_ec.mul_base_ct (design/stdlib/crypto.md
§P-256 arithmetic): for each 4-bit window w (0..63) and digit d (1..15) the
point d 16^w G, affine, its x and y in crypto_ec's Montgomery form (eight
32-bit limbs, R = 2^256).

p256.bin: entry (w, d) is the 64 bytes from (w * 15 + d - 1) * 64, x's 8
limbs then y's, each a little-endian u32; 61,440 bytes. Computed, not
copied: there is no input file. stdlib/tests/gen_p256_comb.tape computes it
with crypto_ec's own complete formulas (16^w G by doubling, its multiples by
adding G's). To regenerate, from the repository root, natively:

    tape build stdlib/tests/gen_p256_comb.tape -I stdlib -o gen && ./gen

A run gives an empty diff. stdlib/tests/crypto_ec_p256_test.tape checks
entries against mul_ct.
