reproducibly_build_Tails_ISO_* job fails when submodules have been updated

 [reproducibly_build_Tails_ISO_stable] $ /bin/sh -xe /tmp/jenkins14098814441176674750.sh
 + git checkout stable
 Switched to a new branch 'stable'
 branch 'stable' set up to track 'origin/stable'.
 + git reset --hard ec7e9c767a72e2f12141c503396405e7fcb1dbc9
 HEAD is now at ec7e9c767a7 Merge branch '20462-upgrade-firmware-nonfree-to-20240610-1' into 'stable'
 [reproducibly_build_Tails_ISO_stable] $ /bin/sh -xe /tmp/jenkins13838824941974799761.sh
 + nproc
 + http_proxy=http://192.168.122.10:3142 TAILS_BUILD_OPTIONS=ram extproxy forcecleanup defaultcomp dateoffset=+1 cpus=3 cpumodel=cpu64-rhel6 ARTIFACTS=build-artifacts/2/
 GIT_COMMIT=ec7e9c767a72e2f12141c503396405e7fcb1dbc9 BASE_BRANCH_GIT_COMMIT=ec7e9c767a72e2f12141c503396405e7fcb1dbc9 rake build

 You have uncommitted changes in the Git repository. Due to limitations
 of the build system, you need to commit them before building Tails:
  M submodules/chutney

 If you don't care about those changes and want to build Tails nonetheless,
 please add `ignorechanges` to the TAILS_BUILD_OPTIONS environment
 variable.

 Uncommitted changes. Aborting.
 Build step 'Execute shell' marked build as failure
 Archiving artifacts

I think that's because we don't update submodules after we git reset --hard.

Presumably the checkout_upstream_job_branch should run git submodule update --init:

https://gitlab.tails.boum.org/tails/jenkins-jobs/-/blob/master/macros/builders.yaml?ref_type=heads#L44

--- a/macros/builders.yaml
+++ b/macros/builders.yaml
@@ -44,7 +44,7 @@
 - builder:
     name: checkout_upstream_job_branch
     builders:
-      - shell: "git checkout \"${GIT_BRANCH#origin/}\" && git reset --hard \"${UPSTREAMJOB_GIT_COMMIT}\""
+      - shell: "git checkout \"${GIT_BRANCH#origin/}\" && git reset --hard \"${UPSTREAMJOB_GIT_COMMIT}\" && git submodule update --init"
 
 - builder:
     name: clean_old_baseboxes

This seems to be obviously the right thing to do, but one thing makes me slightly uneasy: I don't understand why this did not happen before (or I forgot?).

@zen any idea off the top of your head? Should I just try this and see how it works?