Currently when falling back on the clone URL as a base for the LFS url, remote.name.url is always used regardless of the operation.
When pushing, however, to match Git behaviour we should be checking for the existence of remote.name.pushurl and using that instead. Otherwise pushes of LFS data will go to a completely different place to the commits when users have configured things this way (e.g. via a command like git remote set-url --push origin https:/some/push/url.git)
I'm happy to spend some time on resolving this but am just logging it here so it doesn't get lost for now.