Handle empty base with no segments in checkpointSubtreePath

path.Join with no trailing segments cleans a "" base to "." — an invalid git tree key. No current caller hits this (all pass at least one segment), but the helper's contract says it handles the ref root (base=="") safely, so make that true: return "" for the ref root and the cleaned base otherwise. Adds the ref-root-base-only test case to lock the behavior.

Addresses Copilot review on #1576.