Emit ULID checkpoint IDs under the git-refs store

New checkpoints written under the git-refs primary now get a 26-char ULID instead of a 12-hex id, so a checkpoint's id encodes its storage backend (ULID ⟹ ref) — which lets reads route by id kind without config.

• id.GenerateULID(): timestamp + crypto-random ULID (via oklog/ulid, already a dep), canonical and KindULID-valid. Generate() (hex) is unchanged.
• checkpoint.GenerateCheckpointID(ctx): the single place the format is chosen — ULID when the primary is git-refs, else 12-hex. Fail-soft to hex on a missing/malformed config.
• Route the checkpoint-id generation sites through it (attach, the two manual-commit hook paths, the two condensation paths). Turn ids and the investigate run id stay hex — they're format-agnostic correlation tokens.
• Fix explain's auto-ambiguity guard: it assumed a fixed 12-char id width; use the new id.MaxIDLength (26) so a ULID target isn't wrongly treated as un-prefixable.

Storage/read already handled both formats (ShardFor shards ULIDs on the last two chars, RefName/ParseRef/Validate accept them), so no store changes were needed.