Reconcile git-refs branch with main after rebase

Two integration points shifted on main during the rebase:

• syncCheckpointPolicyForPrePush was refactored to a void sync (taking the repo) plus a separate checkpointPolicyAllowsGitHook(ctx, repo) decision. Adapt the git-refs pre-push path to the new two-call shape (open repo → sync → allow-gate) instead of the old bool-returning signature.

• main added several tests that use "refs-v1" as the canonical unsupported / future checkpoint_version sentinel. This branch makes refs-v1 a supported read/write format, so those sentinels must move to the next unsupported version, refs-v2: the CLI policy-print, explain-reject, agent-hook-skip, and the checkpointpolicy CanSatisfy / UnsupportedPolicyMessage tests. Also renamed the export test helper rewriteExportCheckpointVersionToRefsV1 → ...ToRefsV2 to match the version it already writes.