[aft-alfonso]

Stacked on #1017 (views step F). Behind the views switch, which stays off by default; views-off behaviour is unchanged.

Follow-up to step D, which kept every base membership-keyed and always took the full check on rebind.

• A new tree-keyed base kind sits beside membership-keyed bases. Its identity is the full git index tree (built from the index with mode, path and conflict checks, compared against git write-tree in tests for SHA-1 and SHA-256 repositories) plus each member's Git blob OID. Index exceptions (intent-to-add, skip-worktree, assume-unchanged) refuse a tree claim.
• A tree proof records, per member, a blob receipt bound to the bytes read: a clean checkout whose file stats match its receipts rebinds with zero file reads, through step D's existing per-file stat evidence. Any changed file is read again; a base without a holding proof, or any doubt, falls back to the full check. Membership-keyed bases never take this path.
• An older AFT refuses a tree-keyed base under both of its rules (scope prefix and membership digest), and workers cannot register under a tree-keyed scope. The identity is specified in docs/design/views-v3-format.md.
• Tests: a proven tree base rebinds with no reads and the indexed bytes match disk; a membership base always reads; a missing or broken proof falls back; an edited file is read while the unchanged one uses its receipt; the proof names the first check a checkout fails; the older-reader refusal.
• Compile-checked with -D warnings on Linux; 46 views/git-index tests passed.