pre-push: keep refusing held checkpoint pushes when Entire is disabled

Committed settings can disable Entire; that must not release what manual holds back. Also fixes attach --help under manual.