document checkpoint policy unset downgrades

Clarify that empty-value policy unsets inherit the CLI default while still using the normal downgrade guard, so --force may be required.