reuse pre-push repo for policy checks

Open the repository once during pre-push and pass it through checkpoint policy sync and gating.

Document why policy failures skip checkpoint work instead of failing Git or agent session startup hooks.