make_signed_source: Fix orchestration of sbuild sub-workflow

To make this work, I had to fix several idempotency bugs in workflows, and arrange to run pending sub-workflows from the scheduler (via their root workflow) even if the root workflow is already running.

Best reviewed one commit at a time.

Fixes: #695 (closed)