make_signed_source does not run its sbuild sub-workflow when its dependencies complete

The make_signed_source workflow creates an sbuild sub-workflow. That sub-workflow has dependencies that are needed before its orchestrator can run, so it isn't run immediately and should only be run later after its input source package has been assembled.

However, the scheduler only runs root workflows, expecting them to deal with running their sub-workflows. As a result, nothing ever actually runs this sub-workflow.

Right now this is the only case of a sub-workflow that has dependencies (as opposed to creating non-workflow child work requests with dependencies), but it's possible that we'll have more of those in future. We need to work out a good idiom for dealing with this case in general.