fix(ci): checkout submodules for central pr checks

[JSONbored]

Summary

• allow central app PR checks to checkout manifest-approved submodules
• preserve recursive submodule checkout gating on the manifest flag
• update poll/workflow tests for the PR integration-test contract

What changed

• same-repo poll PR targets now carry checkout_submodules from fleet.yml
• manual and poll control-check workflows no longer suppress submodules solely because the event is pull_request
• regression tests cover the updated workflow and poll behavior

Why

The hardened central check now runs integration tests for PRs. Repos such as mem0-aio need their checked-in upstream submodule available for those tests, otherwise the required aio-fleet / required check fails before testing the actual change.

Validation

• .venv/bin/pytest tests/test_poll.py tests/test_control_plane_workflow.py tests/test_control_plane.py
• .venv/bin/pytest
• actionlint .github/workflows/control-plane.yml
• trunk check --no-progress --color=false

Notes

Commit signing was unavailable in the local environment; the commit was created with signing disabled after the signing agent reported no private key.