branch: correctly reject refs/heads/{-dash,HEAD}