checkout: Fix file descriptor leak for copying checkouts

Hardlink checkouts didn't hit this, but we need to close the input
stream.