# DEVX-170: create_dependency_pr checks out the API-created branch

## Problem

After DEVX-169 the dependency branch is created via `POST /branches`, but
`git fetch origin <branch>` only populates `FETCH_HEAD`. The follow-up
`git checkout <branch>` fails silently (`check=False`), commits land on
the wrong ref, and `git push origin <branch>` fails with
`src refspec does not match any`. Observed creating the sso_bridge 0.4.1
infra dependency PR.

## Approach

REQ-1: Fetch the API-created branch into `refs/remotes/origin/<branch>`
and force-create the local branch with `git checkout -B <branch>
origin/<branch>`, both with `check=True` so failures surface.

## Test Plan

- Unit test asserts the fetch refspec and `checkout -B` invocations.

## Deploy Plan

devx release tag; producers pick it up via pin bumps.

## Rollback Plan

Revert; dep-PR creation stays broken (status quo).

## Acceptance Criteria

- [x] REQ-1: the clone checks out the API-created branch so commit and
  push target `deps/<pkg>-<version>`; covered by unit tests.