fix(checkpoints): remove stale shadow index locks

[Veritas-7]

Summary

• Remove stale checkpoint index .lock files before running git commands against per-project shadow indexes.
• Preserve recent locks and locks that changed between stat checks to avoid deleting an active writer's lock.
• Add regression coverage for stale removal, recent preservation, and replacement preservation.

Why

A stale index lock can leave Hermes checkpoints stuck even though no writer is active. Cleaning only old and unchanged lock files makes checkpoint recovery self-healing without weakening active-lock safety.

Tests

• python -m pytest tests/tools/test_checkpoint_manager.py -q -o 'addopts='
• gitleaks git --log-opts='origin/main..HEAD' --no-banner --redact
• git diff --check origin/main..HEAD

Safety review

• gpt-worker-2: PASS.
• epistula: PASS; no private-path/secret/customer/family markers in diff-only scan.

[Veritas-7]

Closing this for now after the local two-reviewer gate found a remaining race window in stale index-lock cleanup. I will rework this into a safer follow-up before reopening/updating a replacement PR.