fix(checkpoint): hint ssh-agent on BatchMode auth failure

Pre-push checkpoint pushes already fail fast under BatchMode=yes; when the failure is SSH auth-shaped, print an actionable ssh-agent hint instead of only a Permission denied warning. Document the touch-only vs PIN-protected security-key tradeoff and the BatchMode=no escape hatch.