pre-push: refuse a branch or tag that points at a held checkpoint

The commit check now compares every pushed line against waiting checkpoint tips, not only sources that aren't full ref names.