fix(strategy): expire the empty-remote bootstrap marker instead of trusting it forever

Addresses trail review on #1744: a permanently-trusted marker means a remote that is later force-emptied (all branches deleted) or recreated empty under the same URL would sail past the guard, letting entire/checkpoints/v1 become the first/default branch again — the exact regression the fix prevents.

Bound the marker's trust with a TTL (pushBootstrapTTL, 1h) keyed on the file's mtime: a fresh, fingerprint-matching marker still short-circuits, but once it expires the remote is re-probed and the marker refreshed on success. This caps the network cost at one ls-remote per interval (vs. per push) while shrinking the re-emptied-remote risk window from "forever" to the TTL.

Adds a test asserting an expired marker is re-validated rather than trusted.