Address ULID review: display, fetch-hint, docs, id-const, lazy mint

Follow-ups from review of the git-refs ULID-emission PR (the id-kind read-routing item, #1, and the write-boundary kind guard, #2, are deferred — see below):

• id.CheckpointID.DisplayShort() (new): kind-aware trim — legacy hex shows its 12-char prefix, a ULID is shown in full (front-truncating a ULID drops its entropy tail and yields an ambiguous, unresolvable prefix).
• explain checkpoint-list view uses DisplayShort instead of a blind 12-char cut, so ULID checkpoints no longer collapse to near-identical timestamp prefixes.
• blame --long sizes the Checkpoint/Session column to its content (attributionCheckpointColumnWidth) so a 26-char ULID + session renders whole instead of being clipped to a session-less 21-char prefix.
• attach's fetch hint now resolves its target via resolveCheckpointFetchTarget — the same path FetchCheckpointRef uses — so the pasteable command matches the remote the fetch actually ran (fixes a bare "git fetch origin …" that fails in a token-only environment with an SSH origin).
• id.MaxIDLength ties to oklog/ulid's EncodedSize instead of a third hardcoded 26.
• eager-condense mints the checkpoint ID only after the skip checks, so a no-op session stop no longer pays the mint (and its checkpoints-config load).
• docs/architecture/sessions-and-checkpoints.md: checkpoint IDs are 12-hex OR ULID (not fixed-width), minted via checkpoint.GenerateCheckpointID.

Deferred to the id-kind read-routing follow-up (tracked separately):

• #1 attach routes presence/refresh/fetch-hint by current config, not by the trailer ID's kind — after a git-branch⇄git-refs flip attach looks in the wrong place and can suggest an unfixable fetch. This is the read-routing work the PR body already names; the two concrete attach dead-ends belong in that issue.
• #2 the ULID⇒refs invariant has no write-boundary guard. A naive "git-branch store saw a ULID → warn" misfires when git-branch is a mirror of a git-refs primary (a valid topology where ULIDs legitimately reach it), so the correct guard needs topology-role awareness and belongs with the routing work.

Tests: TestCheckpointID_DisplayShort, TestAttributionCheckpointColumnWidth.