Merge branch 'main' into soph/doctor-failed-sync-election

719 commits of main, two conflicts, both in files main's new entire checkpoint push reworked.

status.go: main made the unpushed counter injectable (computeCheckpointSyncInfoCounting) so entire checkpoint list --outgoing can pass a counter that reuses the listing it already walked, while this branch had extracted the same block into newDedicatedCheckpointSyncInfo with the package-level counter hardcoded. Either side taken verbatim is wrong: main's loses the helper, this branch's lets the dedicated-destination path walk the queue a second time behind --outgoing's back. The counter is threaded through the helper instead.

setup.go: main gave printEnabledStatus an EnableOptions parameter and an error return so it can make the commit offer; this branch added enableCheckpointNoteHeaders immediately above it. Both kept.

One behavioural change the merge forced. Main's manual checkpoint push policy means a plain git push was never going to carry checkpoints, so the fail-closed note's "Pushes to them carry your code but no session history" blamed the election for what the policy had already decided — the same mis-blame trail finding 01M51C5T8M01 filed against push_sessions=false. strategy.PushCheckpoints resolves the same election before uploading, so the failure is real and still costs the user that upload: the note now names it rather than the git push. Regression test added and mutation-checked.

Verified: cmd/entire/cli and cmd/entire/cli/strategy pass; full gate run before pushing.