pre-push: decide held-checkpoint refusals from clone state

The refusal reads the policy file and git's ref list, not the checked-out branch's settings, refuses an unchecked push when the hook could not save the ref list, and attach no longer calls an unqueued checkpoint waiting.