ci: disable submodule checkout and make checks gating

[heidi-dang]

Summary

• Stops recursive submodule/.local checkout that caused exit 128 in Actions
• Removes failure-masking so build/lint/tests are truly gating
• Notes that CI intentionally skips .local (public repo doesn't need private submodule)

Changes

• Removed "Initialize submodules" step from build-test job
• Removed || true from cmake --preset debug
• Removed || true from cmake --build --preset debug
• Removed || true from clang-format lint check
• Removed || true from ./scripts/test.sh
• Added descriptive comment at top of workflow

Why

The .local submodule is private and cannot be fetched in GitHub Actions, causing checkout to fail with exit 128. Since .local is not required for building or testing heidi-kernel (it's governance/developer docs only), we disable submodule checkout entirely.

Tests run

Local verification only - the actual CI impact will be visible once this PR merges and other PRs re-run.

Related

• Unblocks PR Phase 6: deterministic process cap enforcement (PROC_LIMIT) #31 (Phase 6 Resource Governor)

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.