test(integration): cross-machine clone fetch (C1-C4)

Cover the clone → fetch → read paths for both checkpoint backends.

• C1 (git-branch, HTTPS): exercise the production fetchMetadataBranchIfMissing path — a clone that lacks the local v1 branch fetches it during pre-push settings resolution, no manual git fetch. Runs over HTTPS because local-path origins can't derive a checkpoint URL.
• C2 (git-refs): a clone with no checkpoint refs reads a checkpoint; the on-demand RefFetcher fetches EXACTLY that ref, leaving an unrelated checkpoint's ref absent until it too is read.
• C3 (git-refs): unreachable remote + locally-missing ref. Documents a KNOWN BUG (regression class 7bbdad09c): explain's git-refs prefix-match remote fallback (explain_export.go:216-227) discards the FetchCheckpointRef error and reports "checkpoint not found", masking an unreachable remote as an absent checkpoint. The test self-heals: it skips while the masking is present and asserts once fixed. No production change.
• C4 (both, HTTPS): reading a checkpoint from a fresh authenticated clone auto-fetches its data with the token (v1 branch on miss for git-branch, the exact per-checkpoint ref for git-refs).