findNewBeginElementInRange previously short-circuited when the responder
returned no keys, leaving the caller to assume the requested range was
fully covered. Plumb the request's start hash through the helper and
probe from that origin instead, so an empty-keys response that should
have included data still surfaces a follow-up request.

The probe also relies on visitAll throwing when an in-range node is
missing. That signal is absent when a responder supplies enough proof
nodes to make every leaf reachable through the InnerNodeDiscoveryManager
— the walk completes cleanly even though most leaves were not echoed
back in the keys map. Iterate the inner-node registry afterwards and
surface the lowest in-range leaf that the responder did not include, so
the caller schedules the follow-up fetch.

Signed-off-by: Justin Florentine <justin+github@florentine.us>