checkpoint create: gate on candidate-set completeness, and enforce the rule

ResolvedSession.Incomplete's doc says anything that acts on a session gates on it in addition to IsCaller, and checkpoint create did not. resolveCheckpointCreateSession checked Found, IsCaller and Tracked; with one unreadable state file in the store, the candidate that could have been the nearer owner silently drops out of the listing, an uncontested environment claim wins, and the checkpoint lands on a session that is not the caller's. Measured: with the gate removed, the new test's setup creates a checkpoint on exactly that resolution.

The check is ordered ahead of Found() as well as IsCaller, on the same reasoning the display commands use: "no agent session is running this command" over a store that could not be read fully is the misreading rather than the answer. It stays a refusal rather than a wall because an explicit session ID bypasses caller resolution entirely, which the second test pins.

Written prose was not enough the first time, so the rule now has a ledger with teeth. TestCallerResolutionConsumersHandleIncompleteness enumerates every file that obtains a caller resolution together with what it does about Incomplete — refuse (adopt, checkpoint create), say so (session current, session tokens), or deliberately ignore (withHookSession, which only stamps a log field) — and fails the build on a consumer that is not listed, an entry that outlived its call, or a listed file that never names the field. That last clause is why withHookSession now states its omission in a comment: a reader cannot otherwise tell a decision from an oversight.