Address first review pass on Phase 2 checkpoint stores

Fixes from the implementation review:

• Open no longer newly fails on a non-ENOENT settings read error: the lenient checkpoints loader treats an unreadable settings file (bad perms, settings.json is a directory, etc.) as fail-soft too, defaulting to the git backend and logging at debug. Preserves "no behavior change at default config" even on a broken settings setup.
• Document that Open resolves backend config from the context/cwd (like settings.Load), not from the repo argument, so callers opening a non-cwd repo wrap the context.
• fsstore fidelity: default a zero CreatedAt to now (per contract), carry transcript offsets, prompt attributions, review/investigation fields, the HasReview/HasInvestigation summary flags, and migration-path CombinedAttribution; document that cross-session token aggregation is intentionally omitted.
• fsstore writes atomically (temp + rename) so a reader never sees partial JSON.