Guard checkpoint migration re-runs against ref regression

A re-run compared only the ref tip tree, so a ref that advanced past the migration snapshot through refs-store writes (summary/transcript backfills) would be "re-migrated": a new commit wrapping the stale branch tree, fast-forwarding the tip backwards content-wise and propagating on the next push.

Idempotency now walks the ref's first-parent chain — a snapshot found anywhere in history is skipped. The doctor command additionally refuses to run when git-refs is already the primary store, where the v1 branch may lag the refs and re-importing could only regress them.