rootScratch
The core root computation, mirroring merkle_root_scratch.
Folds the leaf list one layer at a time. At each step it hashes adjacent pairs; if the current level has an odd count it forms one boundary node from the last real hash and the running pad, after which everything to the right is implied padding and never materialised. The running pad is itself folded (pad = SHA-256(pad || pad)), so it always represents the pad node for the level above.
Parameters
leaves
the real leaf hashes for the bottom level (non-empty).
numLeafs
the padded leaf count (a power of two, >= leaves.size).
pad
the pad hash for the bottom level.