Route checkpoints through entire:// push-through mirrors

When origin (or the push remote) is an entire:// mirror URL and its forge matches the configured checkpoint_remote provider (gh <-> github), derive the checkpoint URL on the same cluster (entire://<cluster>/<forge>/<checkpoint-repo>) instead of falling back to direct SSH/HTTPS against the provider host. The provider-host fallback remains for file:// and forge-mismatched mirrors, and ENTIRE_CHECKPOINT_TOKEN still forces provider HTTPS since the token cannot ride through the helper.