enforce local policy after sync failure

When pre-push cannot refresh checkpoint policy from the remote, still honor an already-local policy that blocks checkpoint writes.

This avoids pushing checkpoint metadata with an unsupported writer just because the remote policy check failed.