Gate migrated-ref push on the checkpoint policy

PushMigratedCheckpointRefs flushed the queue without the policy check both pre-push paths enforce, so a policy that blocks checkpoint pushes (diverged or requiring a newer CLI) could be bypassed via the doctor's opt-in push. Apply the same sync-and-gate, returning an error with the refs left queued.

Cover the push entry point: success returns the pushed count and clears the queue; a blocked policy and a failed push both leave refs queued.