resume picker: attribute default-branch checkpoints correctly (legacy fallback)

The legacy branch-resolution fallback skipped the default branch entirely but still walked default-branch history through every feature branch. A pre-Branch-field session whose checkpoint was committed on main/master would either show "no branch" or be mis-mapped to a feature branch that merely contains the commit — and selecting it then checked out the wrong branch before restoring the checkpoint.

Now buildCheckpointBranchIndex indexes the default branch FIRST (so its checkpoints map to the default branch) and records its commit hashes as a stop-set; feature-branch walks halt at shared default history, so they only claim their own branch-only checkpoints. The default branch commit is resolved from the local ref or origin's remote-tracking ref. Still no go-git MergeBase (too slow at scale) — the default-commit set is the cheap stand-in for branch-only scoping.

Test: a checkpoint committed on the default branch maps to it, while a feature-only checkpoint still maps to the feature branch.