fix(checkpoint-remote): route unparseable push remotes to the store

A push remote whose URL does not parse (a bare filesystem path, or an scp-style URL with no owner segment) still fell back to origin even when the configured checkpoint_remote was owned, which is the same misroute the withhold change closed for the derive-failure branch. Both branches now share routeToProvider: target the provider's host, or withhold with ErrCheckpointRemoteUnroutable when the provider has none.

TestCheckpointClaimReport's unparseable-transport case pinned the old fallback; it now expects the confirmed store on the provider host.