fix(enable): first-run refs default yields to ENTIRE_CHECKPOINTS_PRIMARY

The git-branch CI lanes exposed a real divergence: with the env override active (which fully replaces any settings block), first-run enable still wrote checkpoints.primary: git-refs into settings — config on disk disagreeing with the backend actually in use, and the git-branch canary lane (which relied on the old product default) asserting v1-branch behavior against refs-writing binaries.

• firstRunCheckpointBackendDefault: write nothing while the env override is active (pinned by test).
• e2e TestMain now maps E2E_CHECKPOINT_STORE=git-branch to the env explicitly instead of relying on the product default.
• TestSHA256Repository_EnableAndFirstCheckpoint pins --checkpoint-backend branch: it asserts the v1-branch condensation flow specifically.