Checkout clones url into a fresh temporary directory. With an empty revision it does a
shallow clone of the default branch; otherwise it clones and checks out revision. The
returned cleanup removes the directory (call it even on error paths that returned a dir).