fix(opf): push the v1 commit the OPF rewrite verified, not the branch tip

After the pre-push OPF rewrite, the git-branch path pushed entire/checkpoints/v1 by name, so a checkpoint another session appended between the rewrite and the push shipped without being scanned. v1 now ships as the exact commit the rewrite verified; a later append stays local and is rewritten on the next push.

If the remote rejects the pinned push, v1 is still synced with the remote but not retried, since the rebased tip holds unverified commits. OPF skipped or off keeps pushing by name.