add checkpoint policy command

Expose repo-wide checkpoint policy inspection and updates through entire policy checkpoint.

The update path fetches the remote policy before validation, rejects downgrades unless forced, and pushes only the checkpoint policy ref.