update-ref --stdin: pass transaction around explicitly