test: add degraded-remote & protocol-edge coverage (F1, F2, F4, F5)

• F1 (git-branch): a bare-remote pre-receive hook rejecting the checkpoint v1 branch with a GH013-style message drives the protected-ref path: the hook prints its loud one-shot banner and returns, the user's own push still lands, and a repeat push does not retry-loop the rejected branch onto the remote (regression #1033).
• F2 (git-refs slice): pushCheckpointRefWithRecovery wraps its push, fetch+replay, and retry in the same shared checkpointPushBudget as the v1 path, so a stuck transport bounds total wall clock to ~one budget rather than stacking a full budget per attempt. Mirrors the existing git-branch TestDoPushRef_SharedBudget_BoundsTotalWallClock (regressions #1282, 2e2c1b73a).
• F4 (git-refs): the git-refs pre-push path honors the checkpoint policy — a local policy this CLI cannot satisfy skips the per-checkpoint ref push (leaving refs queued) but does NOT abort the user push (regression 7bbdad09c follow-up).
• F5 (git-branch): a session that checkpoints while HEAD is detached, pushed via git push origin HEAD:<branch> through the real hook, syncs and is readable from a fresh clone. Pins current (working) behavior.

F6 (entire:// provider-host routing) is deferred: it needs an injectable provider host table / fake provider mapping that does not yet exist.