Merge branch 'main' into soph/doctor-failed-sync-election

1506 commits of main, four conflicts. One was semantic rather than textual: main narrowed the fail-closed election from "is not a configured git remote" to "has no configured fetch URL", checked against a precomputed fetchable set instead of a per-name probe, because git remote get-url accepts a pushurl-only entry that reads and reconciliation cannot use.

Took main's check and semantics, and kept the typed error on top so the note can still attach a remedy to this cause and no other. Renamed it CheckpointPushRemoteNotFetchableError: the old name described a fault the check no longer tests, since a pushurl-only remote exists and still fails. The doctor/enable report follows — it now says the remote has no fetch URL, spells out that a push-only remote counts as missing, and the remedy points at a remote that has one.

checkpoint_sync_remote_test.go: took main's table (missing / pushurl-only / empty fetch URL — strictly better coverage than the single case here) and folded the typed-error assertion into all three shapes.

status.go: adjacent insertions of two unrelated helpers, kept both. docs/development/checkpoint-implementation.md: main's new same-forge mirror and refused-checkpoint_remote material, with this branch's election paragraph re-appended and updated for the rename.

Verified: pushurl-only remote now reported correctly by doctor and status in a scratch repo; strategy and cli test packages pass.