Push git-refs checkpoints fast-forward-only (no force)

There is no server-side ref protection, so force-pushing per-checkpoint refs by default risks a buggy or racing client silently clobbering good remote history. Switch batchForcePushRefs -> batchPushRefs using a plain ref:ref refspec (fast-forward-only): per-checkpoint refs normally advance by fast-forward so the common case still succeeds, while a genuine non-fast-forward divergence (e.g. the same checkpoint written differently elsewhere) is REJECTED rather than overwritten. On rejection the pre-push logs and leaves the refs queued (not overwritten); reconciling a diverged ref is deferred, and a future rewrite path (e.g. OPF) can use --force-with-lease where it must replace a ref.

Tests: replace the force-overwrite assertion with AllowsFastForward (a descendant update pushes without force) and RejectsNonFastForward (an orphan/divergent update errors and leaves the remote ref unchanged).