Ports the reference's MST.cidsForPath (mst/mst.ts), the algorithm behind com.atproto.sync.getRecord's inclusion/non-inclusion proofs (repo/sync/provider.ts's getRecords -> mst.cidsForPath). Unlike wf_mst_get_covering_proof (built for range queries and pruned to subtrees containing at least one match), this always includes every node visited on the walk down to a key -- including on the path that proves a key's *absence* -- which a pruning range query cannot express: an empty subtree pointer just ends the walk at that node, it never omits it. wf_repo_get_record_proof wraps the walk with the collection/rkey -> MST key construction wf_repo_get_record already does, returning the node path plus (if present) the leaf's value CID separately. This is the missing piece for a proper getRecord implementation (MetalBear's currently ships only commit+leaf with no path, an unverifiable proof); wiring it into a PDS is left to the consumer.