feat: select checkpoint backend via --checkpoint-backend on enable/configure

The git-refs checkpoint backend was fully wired to run but had no config writer, so it could only be turned on via ENTIRE_CHECKPOINTS_PRIMARY or by hand-editing settings. Add a simple selection path for both an existing repo and initial enable.

• --checkpoint-backend branch|refs (also accepts canonical git-branch/git-refs) on entire enable and entire configure. Covers fresh repos, the --agent non-interactive path, and already-set-up repos (enable behaves like configure).
• First-time interactive setup prompts for the backend, defaulting to branch; choosing the default writes no config block, keeping settings.json pristine.
• Backend value is validated up front (before repo bootstrap/hook install) via a new checkpoint.ValidatePrimaryBackend, which is now the single source of the "primary must be git-backed" rule (buildPrimary delegates to it).
• Switching the primary preserves existing mirrors, dropping only one that would collide with the new primary (one-of-each-type rule). Existing hex checkpoints stay readable via kind-routing; no migration needed.