Push git-refs checkpoints from pre-push via the discovery queue

When the configured primary is git-refs, PrePush drains the push-discovery queue and batch force-pushes those per-checkpoint refs (one git push, +ref:ref force refspecs — independent histories, no fetch+rebase recovery) instead of pushing the v1 branch. Default config (git-branch) is unchanged.

• partitionLocalRefs drops stale queue entries (refs deleted locally); surviving refs are removed from the queue only on a confirmed push, so a failed/transient push leaves them for the next pre-push and never blocks the user's git push.
• Shared post-push shadow cleanup extracted to cleanupPushedShadowBranches.

A configured git-branch mirror's v1 ref is not pushed here yet (downgrade-safety mirror push is later), and OPF stays descoped for git-refs.