Merge main into peyton/bound-checkpoint-ref-push

Resolve conflicts with main's checkpoint push policy and pinned-generation delivery: chunked batch, halving split and per-ref fallback now carry checkpointRefPush (exact hash:ref, queue tokens), the flush re-checks the automatic policy, the pre-push hook hands off only after the policy gate, and entire checkpoint push waits out a running background upload.