checkpoint push: keep the policy in its own file and suggest --all

Released binaries drop unknown preferences keys, which released a manual clone. A bare push now lists and exits 0.