git: idempotent clone-or-update (ensure_checkout), and an idempotent branch option