Implement logic to guard against checkout of branch in the case of a duplicate branch and tag

[redshiftzero]

Description

We distribute code to workstations via checkout of a signed git tag. If there is a branch with the same as the tag, then the tag will verify, but when we actually git checkout <tag name> then the branch, not the tag, will be checked out.

Short term

As a guard, implement logic to verify there is no duplicate tag and branch prior to checkout.

Long term

We should stop distributing code in this way and implement #3502

[redshiftzero]

@eloquence had a very good suggestion here (idea shared privately):

I'm curious if git show-ref --heads --verify 0.x.0 may be an alternative to parsing stdout. It returns error code 0 if a branch with this name exists, and non-zero otherwise.

This is a good solution