(OPT) Reuse authenticated Bytes-helper proof and site indexes per module #738

The bounded writer batch adds independent nonallocating Bytes-helper authentication, but checked_bindings currently scans and reserves a cursor separately for every function in a module containing any potentially relevant own-Bytes-to-Bytes signature. Call sites also repeat transitive body/contract proofs. An allocating ordinary helper with the signature can trigger census work although no new renewal site exists.

Observed source: src/loop_calls/byte_writer/resolved.rs, source.rs and bindings.rs in the joined implementation batch (577f0c1). This is source inspection, not a measured token saving or current-head performance result. The new borrowed-key Vec correctly accounts backing before allocation; retain that correction.

Build one bounded module-local authenticated proof/site index and reuse it through HIR validation and cleanup construction/replay. Keep complete body, requires and ensures traversal; exact identity/type/ownership provenance; cycle/depth/work refusal; source/HIR-independent replay; and selective legacy fallback. An attached cleanup plan, name or schema version must not become proof authority. Charge the real retained index and peak construction scratch before allocation, with no phantom uncharged absence walk or opaque BTree-node estimate.

Owning checks must cover allocating legacy helpers, no relevant signatures, direct/imported/transitive valid helpers, cycles, hidden allocation, missing/duplicate/forged facts, source drift, exact/one-short reservation and deterministic graph/cache bytes. Preserve existing fixed workspace/builder caps and hostile cases. Add focused measured construction/replay work on realistic generated codecs; only later matched agent cohorts can establish accepted-task cost effects.

Related: #737 bounded JSON writer; #709 renewal replay indexing. Implement in a larger batch and run owning focused checks at the end, without full quality gates.