on deploy, first fetch all code, and then do a submodule update

This reduces the window of time in which the submodules are in an inconsistent state with each other (i.e. one has been updated without the other).