fix: automate package versions and workspace validation

Tools/CI/Validate-Submodules.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace_root="${1:-$PWD}"
+workspace_root="$(cd "$workspace_root" && pwd)"
+cd "$workspace_root"
+
+if [[ ! -f .gitmodules ]]; then
+  echo "Workspace .gitmodules was not found: $workspace_root" >&2
+  exit 1
+fi
+
+mapfile -t declared_paths < <(
+  git config --file .gitmodules --get-regexp '^submodule\..*\.path$' |
+    awk '{ print $2 }'
+)
+
+if [[ "${#declared_paths[@]}" -eq 0 ]]; then
+  echo "No submodules are declared in .gitmodules." >&2
+  exit 1
+fi
+
+mapfile -t top_level_status < <(git submodule status)
+if [[ "${#top_level_status[@]}" -ne "${#declared_paths[@]}" ]]; then
+  echo "Submodule count mismatch: declared=${#declared_paths[@]} status=${#top_level_status[@]}" >&2
+  exit 1
+fi
+
+for relative_path in "${declared_paths[@]}"; do
+  if [[ ! -e "$relative_path/.git" ]]; then
+    echo "Declared submodule is not initialized: $relative_path" >&2
+    exit 1
+  fi
+done
+
+recursive_status="$(git submodule status --recursive)"
+if grep -Eq '^[+-U]' <<<"$recursive_status"; then
+  echo "One or more submodules are missing, conflicted, or not at the recorded revision:" >&2
+  grep -E '^[+-U]' <<<"$recursive_status" >&2
+  exit 1
+fi
+
+printf '%s\n' "$recursive_status"
+echo "Submodule validation passed: declared=${#declared_paths[@]}"