entire enable/import while logged out imports locally with no way to sync after login

What happened?

Received via support. Running entire enable (or entire import) while logged
out imports agent history into the local entire/checkpoints/v1 store and
prints success ("Imported N turn(s)"), but nothing syncs to the account and the
sessions never appear in the dashboard.

Logging in afterward does not recover them. Because import is idempotent on
local existence, a second run reports "Imported 0 turn(s) (N already imported)"
and makes no attempt to sync — leaving the user with imported-but-unsyncable
history and no first-class way out.

(Root-caused from source below; this is an ordering/UX + missing-sync bug, not a
one-off.)

Steps to reproduce

1. In a repo, before entire login, run entire enable (accept the history
   import) — or entire import <agent>. It prints "Imported N turn(s)".
2. Open the dashboard → the sessions are absent.
3. Run entire login, then re-run enable/import → "Imported 0 turn(s)
   (N already imported)". Still absent; no way to push the already-imported turns.

Entire CLI version

Not captured (received via support). Root-caused from main; reproduces
independent of version.

OS and architecture

Reporter on macOS; not OS-specific (logic is platform-independent).

Agent

Agent-agnostic — reproduces for any importer (Claude Code, Cursor, Codex,
Copilot CLI, Gemini CLI, Pi, Factory Droid).

Additional context

Root cause (verified in code). Import is a local-only, idempotent operation
with no auth awareness and no sync:

• agentimport.Run writes each turn as a read-only checkpoint on the local
  entire/checkpoints/v1 store (cmd/entire/cli/agentimport/agentimport.go:112,
  writeTurn → stores.Persistent.Write at :249) — it never contacts the
  account.
• Idempotency is keyed on local existence: existing checkpoints are listed
  and any whose deterministic ID already exists are skipped
  (agentimport.go:123-128, 147-151), so a logged-in retry skips everything and
  never retries a sync.
• Neither entire import (cmd/entire/cli/import_cmd.go) nor the enable import
  offer (cmd/entire/cli/setup_import.go:48 maybeOfferSessionImport, :224
runSelectedImports) gates on or checks login. The enable offer is also
  first-run-only (setup_import.go:49), so a later logged-in enable won't
  re-offer.

Sync happens only via the git pre-push hook, gated on a git push:

• PrePush ships the checkpoint refs/branch alongside the user's push
  (cmd/entire/cli/strategy/manual_commit_push.go:39, :152). Default backend
  is git-branch (cmd/entire/cli/checkpoint/open.go:36, PrimaryIsRefs(nil)==false),
  so the whole entire/checkpoints/v1 branch — including imported commits —
  ships on push.
• Publication is deferred on an empty remote until the user's own branch
  exists there (manual_commit_push.go:76, 186).
• enable only reports the enablement to the backend best-effort, and that
  report is silently skipped when logged out (cmd/entire/cli/setup.go:972-1032
reportRepoEnabled).

Net: three stacked gaps — (1) import writes locally with no login signal;
(2) there is no push trigger for commit-less imports on the default git-branch
backend (the pre-push hook on git push is the only one; PushQueuedCheckpointRefs
at manual_commit_push.go:285 exists but is git-refs-backend only); (3)
local-existence idempotency masks the never-synced state so login can't recover it.

Impact

• First-run-before-login (a common order) silently drops imported history from
  the dashboard with no obvious recovery.
• "Imported N turn(s)" is misleading — it means "written locally," not "synced."
• Recovery today requires connecting the repo, ensuring the remote has a branch,
  and making a commit + git push to fire the pre-push hook — undiscoverable.

Expected behavior

• Importing while logged out should say the data is local-only and won't appear
  in the dashboard until the user logs in and syncs (don't fail — keep offline
  import working).
• After login, a first-class way to sync already-imported (commit-less)
  checkpoints, without a manual commit + push.
• Success message should distinguish "imported locally" from "synced."

Suggested fixes

1. Warn on logged-out import (in import_cmd.go and setup_import.go
runSelectedImports).
2. Provide a sync trigger for imported checkpoints: push on authenticated
   import/enable; or have login/enable detect unpushed imported checkpoints
   and offer to push; or add entire import --sync / entire checkpoint push.
   Needs a branch-backend push path usable outside the pre-push hook (parallel to
   PushQueuedCheckpointRefs).
3. Clarify the success message (local vs synced).

Areas to update: cmd/entire/cli/agentimport/agentimport.go,
cmd/entire/cli/import_cmd.go, cmd/entire/cli/setup_import.go,
cmd/entire/cli/strategy/manual_commit_push.go.

Suggested tests: logged-out warning shown / logged-in not; post-login sync
actually pushes prior imports (not a no-op); idempotency holds for the
already-synced case; success-message wording.

Open question (server-side, out of this repo's scope): confirm with the
backend team that a connected-repo git push of entire/checkpoints/v1 is
sufficient for dashboard ingestion (GitHub App), and whether the CLI should nudge
the "connect repo / install GitHub App" step when enabling while logged out.