One root prevents competing authorities

A second root creates competing authorities — whose checksums win, whose version controls compatibility? index.json is the one file that speaks for the container: version, identity, provenance, checksums, the segment lists. Everything else is reachable from it, and nothing else may claim its job.