Pkg.checkout: pull from origin by default.

Not doing this was just too confusing. You can still opt out.