add hidden checkpoint policy command

Store the repo checkpoint policy in a dedicated git ref and expose a hidden command for inspecting and updating it.

The command syncs with the checkpoint remote before updates, rejects unsupported versions, and pushes only the policy ref.