Optional tree provider for family merges, cross-checked against git

[nybarius]

Adds an optional tree provider for the family merges: [merge] tree_command names an alternative merge engine, and tree_timeout_seconds (default 120) bounds each call.

For every merge step the train already builds (each head folded in order onto the base or the fold so far, both while planning a family for its gate and while preparing each branch for its merge), the command runs in the clone with SVRF_MERGE_OURS, SVRF_MERGE_THEIRS, SVRF_MERGE_BASES and SVRF_CLONE, and prints a tree id. Git's own merge tree is always computed as before. The step uses the proposed tree only when it is git's tree (tree_source: "provider"); a different tree, a non-zero exit, a timeout (the command's process group is killed), unreadable output or an unavailable command keeps git's tree and records the reason (tree_source: "git", tree_provider: <reason>, plus proposed_tree on a mismatch). The provider can never put a tree on the base that git did not produce, and never holds, fails or stops anything.

Only steps git merged into a new commit are offered; conflicts, already-merged heads, the pair read, admission, repairs and re-lands never run it. Receipts carry the per-step source and a tree_provider total (consulted, provider, git, reasons); the round summary and last_tick carry the round's totals.

Unset (the default), no command runs, train_options is unchanged and receipts are byte-for-byte as before (tested).

Tests first (test: ..., failing on the missing module), then the implementation, then docs (docs/TREE_PROVIDER.md, README configuration and safety tables, example config, changelog). 339 tests pass locally.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.