fix(opf): pin checkpoint delivery to verified generations and cap per ref

git-refs delivery checked the OPF trailer on one ref tip and then pushed the symbolic ref, so a concurrent write could ship a later, unchecked tip. Queue cleanup removed refs by name and could erase a newer generation. And the byte caps were counted across every queued ref, so one large session withheld all of them.

• The push queue records (ref, hash) generations. Delivery pushes the exact hash whose trailer it verified and removes only that generation; rotation after a bounded flush moves exact generations too.
• Divergence recovery replays the exact candidate and installs it only if the local ref still names that candidate.
• Each queued ref is collected, capped, scanned, and rebuilt on its own, so a ref that trips a cap or fails stays queued while its siblings ship.
• Each blob's size is checked against the raw-byte budget before it is read.
• doctor migrate-checkpoints reports refs that landed before a failure.