fix(strategy): gate checkpoint_remote bootstrap fetch to explicit enable flow

EnsurePrimaryRef's bootstrapPrimaryFromCheckpointRemote runs a network fetch (up to 30s) when the local primary metadata ref is missing and not fetchable from origin. EnsureSetup, which calls EnsurePrimaryRef, executes synchronously on every TurnStart hook — so a slow or unreachable checkpoint_remote could stall the hot hook path (hooks are killed at 30s) before the empty-orphan fallback ever ran, repeating the expensive fetch on every subsequent turn instead of self-healing once.

Gate the bootstrap fetch behind a new WithCheckpointRemoteBootstrap context marker, set only by the explicit entire enable / agent-setup flows in setup.go. The per-turn hook path (lifecycle.go) no longer opts in, so it stays network-free and falls back to the empty orphan immediately when the local ref is missing.