fix(strategy): defer checkpoint push until a normal remote branch exists (#1743)

When Entire is enabled before a repository has any branch on its remote, the pre-push hook could independently publish entire/checkpoints/v1 ahead of the user's first normal branch. On an empty GitHub repo that metadata branch can become the repository default branch.

Route the Git pre-push hook through a new PrePushFromGitHook that, for the user's push remote, inspects the actual push target(s) (including a distinct pushurl via git remote get-url --push --all) and defers automatic checkpoint publication until a non-metadata branch exists there. A configured, separate checkpoint_remote is intentionally exempt. The OPF rewrite still runs before deferral so a user push that explicitly includes v1 stays redacted. Deferral fails closed: the user's push proceeds and a later push publishes the queued metadata.

Adds integration coverage on both checkpoint backends (empty remote and empty pushurl target) plus a unit test asserting OPF runs during deferral.