Add per-checkpoint ref resolver (ShardFor + RefName/ParseRef)

First slice of the per-checkpoint git-ref checkpoint store (#1471), on top of the merged understanding layer. Pure naming/resolution; nothing constructs a ref store yet.

• id: re-add CheckpointID.ShardFor (first-2 chars for legacy hex, last-2 for a ULID so the random suffix spreads evenly while the ID stays sortable) and the CheckpointID.Kind() method. These were deferred out of the understanding-layer PR (#1546) because sharding is a storage concern; they land here with their consumer.
• checkpoint: RefName builds refs/entire/checkpoints/<shard>/<id>; ParseRef inverts it, rejecting a mismatched shard or extra path segments so a malformed ref never resolves to the wrong bucket.