Return checkpoint policy errors verbatim

Address review feedback on the checkpoint format compatibility work.

Make unsupportedVersionError a value-based error wrapping a package sentinel, and detect it with errors.Is instead of errors.As. Drop the no-op fmt.Errorf("%w", err) wraps at every EnsureCanReadVersion call site so the clean, purpose-built policy message reaches the user.

Add checkpointpolicy to wrapcheck's ignore-package-globs, mirroring the existing coreapi entry: the policy error is already user-facing and is classified by callers via IsUnsupportedVersion, so wrapping would only obscure it.