MergeOp: Reload changes and double-check submitted status

Secondary index reads in theory shouldn't be delayed, but who knows,
they might be. Don't trust the change populated from the
InternalChangeQuery call, and reload it from the db instead. If the
change isn't actually submitted, skip it. This also narrows the window
wherein a human abandoning a change can race with the submit queue.

Change-Id: I1254f3d3def55cd1a39647cc8e5873c08373c465
2 files changed