Resume a session without a branch, and share one to be resumed

session resume took a branch, so a session that never committed could not be resumed by anyone else: no commit trailer names its checkpoint and no branch holds it. An investigation, a review, a dead end worth handing over had nowhere to go.

Route the positional argument through the same auto-detect ladder checkpoint resume already uses, so a checkpoint ID resolves with no branch — the session log is restored in place and the ref is fetched on demand. Branch targets are unchanged. Hints that name a command to re-run now build it from the invoked path, since the resolver is shared by two commands and must not send the user to the other one.

Add session share: checkpoint create plus the push. It writes a snapshot checkpoint, pushes it to the checkpoint remote, and prints the session resume <id> line to hand over. The snapshot leaves the session's own checkpoint window alone, so sharing mid-investigation costs the next commit's checkpoint nothing.

Session resolution is checkpoint create's, so only a positively identified caller is shared; the most-recent-session tiers are guesses and publishing a transcript on a guess publishes someone else's. The remote is resolved before the write, so a repo with nowhere to push fails before leaving a checkpoint behind. Pending file changes are refused by the snapshot writer; share turns that into commit-first guidance rather than surfacing the sentinel.

The push goes through PushSharedCheckpoints, which dispatches on the primary backend the way pre-push does: queued refs for git-refs, where failures are surfaced rather than logged, and the v1 branch otherwise. EnsureRedactionConfigured runs first because both halves need it — the write must not fall back to the default scanner set, and the OPF gate reads unconfigured as "off".