fix checkpoint policy enforcement

Reject unsupported checkpoint reads and user-driven checkpoint writes consistently.

Resolve policy refs through the configured checkpoint remote and skip checkpoint pushes when local policy state diverges from remote policy.