address checkpoint policy feedback

Preserve local policy history when updating and reject true divergence before rewriting the policy ref.

Accept SHA-256 object IDs from remote policy refs and keep policy upgrade warnings enabled for hidden user aliases while still excluding hidden infrastructure commands.