fix(cli): avoid protected ancestors during checkpoint cleanup