checkpoint push: address trail findings on policy reads, wording and tests

Status reads the policy only on git-refs, a broken checkpoints config is reported instead of read as git-branch, unpinned pushes don't say 'since you looked', and docs note that an older binary ignores the policy.