bug(build): reject builds whose submodule checkouts do not match pinned gitlinks #717

Problem

Agent Code can build and preview a dirty checkout whose initialized submodule HEAD does not match the parent repository's pinned gitlink. Because the app compiles TypeScript directly from submodules, the resulting bundle can silently omit merged fixes while the parent commit appears current.

Evidence

On 2026-08-30 the running app reported parent commit f9808301, whose Codex gitlink was c9b7b4aa, but the initialized packages/codex-headless checkout was 4e10c167. The app built and launched successfully, omitting the exact proxy-rollout identity fix already merged via #703.

Acceptance

• Production build and preview/start fail before compilation when an initialized submodule HEAD differs from the pinned gitlink.
• The error identifies the exact path, expected gitlink, actual HEAD, and remediation command.
• Matching submodules pass.
• Ordinary uncommitted changes inside a submodule are reported separately but do not masquerade as a gitlink mismatch.

Related: #703.