fix(checkpoint-remote): keep path push remotes on origin's host; actionable withhold

Addresses review findings on the unparseable-push-remote routing:

• A push remote whose URL does not parse now derives the store from origin's transport before falling back to the provider host, so a self-hosted origin keeps its checkpoint store on its own host instead of github.com.
• The unroutable error no longer quotes the parse cause (which can carry a remote URL's raw bytes into status, enable and attach output); the cause is logged instead. The error now says what to do: point checkpoint_remote at a github or gitlab repository, or remove it.
• The withhold tests push to a reachable bare repository with a queued checkpoint ref and assert nothing lands there, so a regression delivers and fails rather than failing quietly on the network.