Verify that build is idempotent when `--check` is used

[eibens]

When the --check option is used:

1. ensure the cwd is a clean git repository
2. run the build task
3. check git for changes
4. if repository is clean, succeed
5. else reset and fail

This was copied from #44.