Metadata for one root commit. Message bytes are preserved, including newlines.
Names and emails must be nonempty, with no control bytes or angle brackets;
messages may contain newlines but not NUL. Invalid metadata returns InvalidObject.
Incrementally collect root entries in caller-owned slots, without allocation.
Push accepts any arrival order; borrowed subtrees must already be assembled.
Nested validation and tree/commit buffer sizing are checked when finishing.