checkout: use add_pending_{object,sha1} in orphan check