fix(strategy): bound the empty-remote probe so a stalled remote can't block git push

Addresses trail review on #1744: deferCheckpointPushOnEmptyRemote ran PushTargetsInDir and LsRemoteInDir on the raw hook ctx, which carries no deadline — unlike every other network call in this package. The probe runs synchronously inside pre-push, before the user's actual git push starts, so a stalled or unreachable remote would hang the entire push indefinitely on every invocation until the bootstrap marker is set.

Wrap the probe (target resolution + per-target ls-remote) in a single context.WithTimeout (pushBootstrapProbeTimeout, 10s — matching the package's other small remote reads). A timeout flows into the existing fail-closed paths: metadata publication defers while the user's push proceeds.