build: ensure that a release build fails when a submodule is unclean * top/maint.mk (no-submodule-changes): New rule. (alpha beta major): Depend on it.