Let session attach decide how to link from the commit

attach linked by a flag: without --commit it amended HEAD (prompting, or -f), with --commit it always recorded the link in the checkpoint and refused unpushed commits unless --allow-unpushed. People and agents had to know which mechanism a commit needed, and a headless attach still left the checkpoint unlinked.

The link now follows from the target commit (HEAD unless --commit):

• it already has a checkpoint: join it;
• HEAD, not pushed: amend in the trailer, no prompt (it survives a later rebase, and nobody else has the commit);
• already pushed: record the link in the checkpoint, leave the commit alone, push the checkpoint;
• older and not pushed: refuse before writing anything.

The amend prompt and --allow-unpushed are gone; -f is kept hidden as a no-op so existing scripts keep working. A recorded link to a commit the local git author didn't write warns that it won't count. attach --help, the new agent-help guidance and the architecture doc state the rule.