* opt.: include core repos via submodules * fix: checkout submodules in analysis workflow * fix: scope analysis to app sources * refactor: move direct-included repos under packages