ci(release): check out nested submodules

[oneandonlydean]

What

build.yml fetches submodules with git submodule update --init --recursive, but release.yml checks out with submodules: true, which only fetches the top level. #3897 adds Mbed TLS, whose CMake needs its nested framework submodule, so the first release after it would fail at configure while the full build passes. This makes the release checkout recursive, like the build.

Tested

• Not run: the release workflow only runs on tags. The same recursive fetch is what build.yml already does on every full build.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• AI-assisted: yes