refactor(import): store imported checkpoints on v1, not a separate ref

Imported checkpoints now live on entire/checkpoints/v1 (tagged Kind:imported) instead of a local-only entire/imports/v1 ref. They are redacted and pushed like normal checkpoints, which is what lights up server-side search/recap/UI.

This collapses the read paths back to a single store and fixes two bugs that came from the two-ref design:

• explain <imported-id> now resolves (was: not found, only consulted v1+shadow)
• imported checkpoints no longer duplicate as [temporary] (shadow-branch scanner no longer mis-reads a second metadata ref)

Removes ImportsRefs/OpenImports/ImportsBranchName and the read-path unions; keeps Kind:imported, provenance, the [imported] label, rewind refusal, and the deterministic-ID idempotency.