on commit to submodule:
  zephyr
  nothing else?

superrepo heads are dev, prod
on commit to superrepo:
  for each changed submodule revision:
    (as optimization: if same commit already in dev, just reprepro move)
    try to build submodule
    if fail, abort -- whole commit, probably; else
    tag submodule with version
    upload to dev/prod respectively
  actually commit
  zephyr

This makes a long pre-receive process.  Is that cool?
Probably is the right thing.