Proofs over views (V16) #322

Part of epic #305.

Problem. .why runs a full evaluation of the closure with derived output before backward chaining (src/protocol/handler.rs:758; src/storage_engine/snapshot.rs:451-463); .why_not has no derived data (handler.rs:888-892); negated body atoms are checked against base data only (src/provenance/prove_body.rs:85-88). Recursive proofs are still cubic in closure size (fm/fix-why-recursive follow-ups).

Target. Proof search reads derived tuples from the view arrangements at the pinned revision (the snapshot the writes committed against, handler.rs:3333-3341, via at), no evaluation; .why_not gets the same derived data; negated derived atoms are checked against the view; proof trees carry the revision as today.

Acceptance. pinned_proof_tests, proof_snapshot_tests, why_not_tests pass in maintained mode; rule_evaluations = 0 during .why; perf gate why_recursive_cyclic unchanged or better; a negated derived atom test.

Size M. Dependencies V9, V13. Order slot 6.