enforce checkpoint policy compatibility

Warn interactive users when the repo policy requires newer checkpoint support.

Reject user-driven checkpoint reads for unsupported formats, and skip checkpoint writes or pushes from hooks when the configured policy cannot be written by this CLI.