Make attach checkpoint-presence backend-aware (git-refs)

attach's ensureCheckpointAvailable gated on the v1 branch existing before reading the configured store. Under the git-refs backend a checkpoint lives at its own ref (refs/entire/checkpoints/<shard>/<id>) and there is no v1 branch, so a valid ULID checkpoint was reported "missing" and attach refused — even though the ref existed locally. The refresh path also only fetched the v1 branch.

Now:

• checkpointPresentLocally reads through the configured primary store directly. The local-Primary-ref gate (which prevents counting origin remote-tracking presence and clobbering the remote on push) is kept for git-branch only; for git-refs the store read is already local-only (attach wires no ref fetcher).
• refreshCheckpoint is backend-aware: git-refs fetches just this checkpoint's ref via FetchCheckpointRef, git-branch fetches the whole v1 branch as before.
• the refuse error and suggested fetch command name the right storage per backend (shared suggestFetchCommand helper avoids duplication).

Also isolate generate_test's default-primary case to an empty worktree so a developer dogfooding git-refs in their real .entire/settings.json can't turn the empty-env default (which falls through to the settings file) into a ULID.

Adds TestAttach_GitRefsBackend_AppendsToExistingCheckpoint; the git-branch refuse/remote-tracking regression tests are unchanged and still pass.