checkpoint: keep one map behind the checkpoint listing

List tracked the same checkpoint IDs twice: indexByID, to let a canonical ref replace the entry a folded one contributed, and a seen set, to tell remote discovery which checkpoints were already listed. Their key sets were identical by construction, held so only because both writes sat on the one path that appends.

That was correct — the presence set could not go missing for an appended checkpoint, since nothing else appends — but it is an invariant a reader has to reconstruct, and the cost of getting it wrong is a checkpoint listed twice. indexByID now answers both questions, and the collapse removes the question rather than documenting the answer.

The added test is a guard, not a fix: it passes before this change too. It pins the interaction that would break first — a checkpoint already collapsed from two local spellings must not come back as a remote stub.

Refs #2402