Regarding the submodule question: I decided to test it and came up with this script: https://gist.github.com/Meneth32/bdb17a8787fc0ab197805d8d0cf...

On debian 13 (trixie) with git version 2.47.3, it runs without error. You CAN use sha1 submodules in sha256 repos.