maint.mk: add pre-release check to ensure submodule commits are public