migrate-to-ulid: switch the repo onto the git-refs backend

The migration created ULID refs and enqueued them for push, but left checkpoints.primary unset — so the configured backend stayed git-branch, the pre-push hook took the v1-branch path, and the queued ULID refs were never flushed. Symptom: git push says "Everything up-to-date" while the refs sit in .git/entire-checkpoint-push-queue.jsonl forever.

--yes now writes checkpoints.primary = git-refs into .entire/settings.json (preserving other keys; creating .entire if absent), so the repo is genuinely on the refs backend: reads route to refs and the pre-push hook flushes the ref queue. The final message notes the settings change and that a git push flushes the refs (the pre-push hook runs even when the branch is up to date).

Test asserts checkpoints.primary is git-refs after apply.