Doesn't that require both coins using the same elliptic curve?
1. A lot of altcoins just copy-pasted secp256k1, so it is not a big deal.
2. Read about DLEQ proofs. It is possible to prove, that the same private key was used on two completely different curves, and then execute a contract in that way.
We could have that decentralized DNS with OP_CSFS, but I cannot think of any other ways.
There are a lot of other ways. The simplest example, which is used even today, is related to vanity addresses: you have a regular Bitcoin address, but you can mine N characters in the name, and have some unique identifier. Even better: imagine what would happen, if you would mine some Silent Payment address, to avoid address reuse.
And that way is not only limited to Bitcoin: people also mine *.onion domains, in exactly the same way.
Do you understand what the OP is talking about?
As far as I know, a "basic generic Elliptic Curve Point Contract functionality" is what you will have, if you introduce OP_CHECKSIGFROMSTACK. But yes, you can have "<pubkey> <pubkey> OP_PUBKEY_ADD" or "<number> <pubkey> OP_PUBKEY_MUL" instead (or even "<numberAdd> <numberMul> <pubkey> OP_PUBKEY_MUL_WITH_ADD"). But in general, a signature is "multiplication and addition". Which means, that if you can sign any given message, then you unlock "mul and add" functionality, just by packing those two 256-bit numbers as a single signature.
Edit: By the way, you already have some "basic generic Elliptic Curve Point Contract functionality". Try this Script: "<signature> OP_SWAP OP_CHECKSIG". Then, you should push the proper public key as a solution.
Even better: try this: "OP_TOALTSTACK <signatureAlice> <signatureBob> 2 OP_FROMALTSTACK OP_DUP 2 OP_CHECKMULTISIG". Then, you just create "OP_0 <pubkey>" as a spending Script, and you have to find a key, which will match both signatures at the same time.
Edit:
There are a lot of other ways.
I guess there are more ways than people can imagine. For example, vanity addresses can be reused. However, there are things, which cannot be reused: transaction IDs. Which means, that you can just mine your transaction ID, and then share it. If anyone will change anything, then the name will be gone, and the ID will also change. It will be confirmed once or never. It will be always unique.
Also, no additional fields are needed. If you disable locktime, you can just use it as a nonce, and mine your transaction quite quickly. Other options, related to tweaking public keys or signatures, are much slower.
I'm pretty sure you are mainly discussing off chain and side-chain contracts, the scripts you provided might already serve that use case, however more complex / flexible ECC scripting conditions would enable native contracts reducing reliance on a side chain or off chain client side validated contract.
L2s can use this to build more useful UX, for example with Point Time Lock Contracts the lightning network would now be able to build lightning native privacy protocols and multi-sig custody protocols where previously the hash based contracts limit the extensibility of Lightning altogether. That's a relatively simple example, but ultimately more flexibility would open the flood gates in terms of scaling solutions.
This is in juxtaposition to each scaling protocol needing to settle with an extremely strict or at least specific standard which puts more limitations on the flexibility of the end product. I forgot to mention scripts like InspectInputValue and InspectOutputValue are probably required too (they exist on liquid already) however I think that's good because all of this is just very basic straightforward scripting that doesn't require a programmer to study a long document to figure out how it works in detail. Yes one has to study ECC if they want to build a scaling protocol but that is a well documented subject already and wont need redefinition to include into Bitcoin.
You could have PUBKEY_MUL but you could also just have basic EC_MUL I really don't see why not, it should be up to the protocol developer to determine what curve (and protocol math) they are using. That may also be used for migrating to different curves without hardforks. All you have to do is provide the correct generator point which can easily be supplied by a library that you use to build your scripts. Maybe we will never have to change the curve but if we want to be able to flexibly interact with cryptographic protocols that use other curves, this feels necessary. Or in the case where the curve is irrelevant and you simply want to use the points for any kind of cross-protocol computation, the scripts need to be completely functional as to not limit the expressiveness of the protocol.
That also means alt-chains like XMR that use a different curve might gain more compatibility in protocols like atomic swaps which might help reduce interactivity. Atomic swaps are already possible with XMR except they are unidirectional until XMR hard-forks to allow pre-signed txs. The really positive thing is you could potentially use generic curve point scripts to build privacy protocols on top of Bitcoin, maybe a bulletproof or pedersen commitment script or something like that.
I think another positive result would be that the costing of executing these scripts would be transparent, you shouldn't be able to exhaust a nodes resources by creating some kind of hidden verification loop that might go undetected in a script that comes in the form of a large expected template. Current scaling proposals AFAIK have not considered how to tackle costing for every script that can possibly be written for their templates, likely because that is a huge undertaking to consider. Without granularly applying weight to each operation it cant be done in a fair way IMO.