Non-submittable docstatus guard in ORM

ORM-level docstatus guard reverted from #41280 because v16 still supports internal submissions of non-submittables; guard belongs in Desk.