fix(import): redaction config + provenance privacy for imported checkpoints

Address review findings on imported-checkpoint history:

• Call strategy.EnsureRedactionConfigured() before import writes so imported transcripts honor opt-in PII, custom_redactions, and redactor packs, not just always-on secret scanning. Covered by a custom-redaction test.
• Store only the transcript basename (transcript_file) in provenance instead of the absolute path, which leaked local usernames/repo layout onto the shared v1 branch.
• Hash the redacted turn slice instead of raw bytes, closing a confirmation attack against guessed raw prompt/output content.
• Gate the explain "--generate" hint on summary.Imported, since imported history is read-only and --generate is refused.