[zenith] chore: enforce submodule notes for every gitlink

[bigduu]

Context

Independent review of #115 found that Validate Submodule Pointers dynamically discovers all changed mode-160000 paths, but Require Submodule Notes (PR) uses a static watched set containing only .gitmodules, bamboo, bodhi, and lotus. A future pointer-only update for Jiandu, Nova, Lotus Next, Magpie, Pavilion, or Bodhi Server can therefore bypass the required ## Submodule Updates notes when .gitmodules is unchanged.

This is a pre-existing P3 workflow-hardening gap and is intentionally separate from #114.

Acceptance criteria

• Detect changed gitlinks dynamically rather than maintaining a partial static path allowlist.
• Require a concrete ## Submodule Updates section for every added, removed, or updated gitlink.
• Keep the edited PR event behavior so correcting the PR body reruns the gate.
• Add regression coverage for a pointer-only change to jiandu and at least one other currently omitted submodule.
• Preserve the existing no-submodule-change fast path.

Non-goals

• No submodule pointer changes.
• No release-train changes.
• No Jiandu source changes.

Found during independent review of #115.

[bigduu]

Reproduced again on PR #164 at exact head f3941a62c41113ab282084e0c82abb8a30939a4c: the only diff was the mode-160000 lotus-next pointer, but Require Submodule Notes (PR) logged No submodule pointer changes detected. because the static watched set omits lotus-next. The PR body did contain a correct ## Submodule Updates table and was independently reviewed, while Validate Submodule Pointers correctly checked out and verified lotus-next@b0bc55f63d786e01c902984835218f7789e3b0cb. This is additional live evidence for the existing dynamic-gitlink acceptance criteria; it did not block #164.