checkpoint: split the temporary store out of GitStore

Extract the shadow-branch (temporary) surface into an independent ephemeralStore type, leaving GitStore as the committed (persistent) store. The two share only package-level helpers (CreateCommit); there is no shared receiver. This is the structural groundwork for the persistent/ephemeral rename and the generic Read/Write surfaces.

• temporary.go + shadow_ref.go methods now hang off *ephemeralStore.
• Open() constructs an ephemeralStore for Stores.temporary; GitStore serves the committed surface only.
• Add exported NewEphemeralStore(repo, refs) for benchmarks/tests that drive the shadow-branch surface directly (production reaches it via Open().Temporary()).
• benchutil gains an Ephemeral field; temporary-only tests construct the ephemeral store. No behavior change.