* Forged tree (attacker claims 16 leaves):
 *
 *                             [**root**]
 *                      __________/  \__________________
 *                     /                                \
 *                   14                                 c                   Height 3
 *                _ /   \ _                    _______/   \_____
 *              /           \                 /                 \
 *             6             13              b                   b'         Height 2
 *           /    \        /    \         /      \            /     \
 *          2      5      9      12      17       a         17'      a'     Height 1
 *         / \    / \    / \    /  \    /  \     /  \      /  \     /  \
 *        0   1  3   4  7   8  10  11  15  16   18  18'   15' 16'  18' 18'  Height 0
 *        ----------------------------------------------------------------
 *        0   1  2   3  4   5   6   7   8   9   10   11!  12! 13!  14! 15!
 *
 *     Nodes with ! are phantom leaves. The attacker duplicated the entire
 *     subtree under 'b' to create fake leaves 11-15.
 *
 * The attack works because:
 *   - Real proof for leaf 9:    [15, a, b', 14] with b' as RIGHT sibling
 *   - Forged proof for leaf 13: [15', a', b, 14] with b as LEFT sibling
 *
 * The CVE guard detects this: in forged proofs, a duplicate will appear as a
 * LEFT sibling (sibling == current when index bit is 1). Legitimate duplicates
 * from bagging only appear as RIGHT siblings.