fix(enable): fetch existing checkpoint_remote branch instead of orphan

When entire enable runs in a repo that has a dedicated checkpoint_remote configured and that remote already holds entire/checkpoints/v1 (e.g. a second device), EnsurePrimaryRef only bootstrapped the local metadata ref from origin's remote-tracking ref. With checkpoints living in a separate remote, no origin tracking ref exists, so it fell through to creating an empty orphan. That orphan diverges from the real branch: checkpoint list shows nothing and later fetches are rejected non-fast-forward.

Before creating the orphan, when a checkpoint_remote is configured, do a best-effort fetch of entire/checkpoints/v1 from the resolved checkpoint URL into the local primary ref (tmp-ref + SafelyAdvanceLocalRef promotion). All resolution is pinned to the target repo's worktree so the decision depends on the repo being ensured, not the ambient working directory. Any failure falls back to the existing empty-orphan behavior so enable never breaks.

Closes #1374