Running `git submodule update --recursive --init` should be totally fine
for us and it gives us more auditability because then the submodule
commit hash is pinned by the main git repo tag.
* `set -o pipefail -o errexit` exit early on error. This is very useful
to not overlook errors that might not fully break the build but tamper
with the end result.
* Fix `mkdir OUTPUT_FOLDER` fail
* Rework git checkout stuff to only run needed commands.
