chore: pnpm lockfile, info-defi-oracle-138 app, token-lists, OMNL discovery output

- Refresh pnpm-lock.yaml / workspace after prior merge
- Add Chain 138 info hub SPA (info-defi-oracle-138)
- Token list and validation script tweaks; path_b report; Hyperledger proxmox install notes
- HYBX implementation roadmap and routing graph data model

Note: transaction-composer is a nested git repo — convert to submodule before tracking.
Made-with: Cursor

.env.master.example

@@ -34,6 +34,10 @@ CLOUDFLARE_TUNNEL_ID_MIFOS_R630_02=
 CLOUDFLARE_TUNNEL_TOKEN_MIFOS_R630_02=
 CLOUDFLARE_ORIGIN_CA_KEY=
 CLOUDFLARE_ACCOUNT_ID=
+# Turnstile (Captcha) for IRU marketplace inquiry — Dashboard → Turnstile; NOT the DNS API key
+CLOUDFLARE_TURNSTILE_SECRET_KEY=
+# dbis_core Vite marketplace: VITE_CLOUDFLARE_TURNSTILE_SITE_KEY=
+# Sankofa portal Next.js (sibling repo): NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY=
 
 # --- ClouDNS ---
 CLOUDNS_AUTH_ID=
@@ -100,10 +104,18 @@ AWS_S3_BUCKET=
 AZURE_STORAGE_CONNECTION_STRING=
 AZURE_STORAGE_CONTAINER=
 
+# --- Pinata (IPFS pinning; token logos) ---
+# Dashboard: https://app.pinata.cloud — API Keys → JWT or key/secret.
+# scripts/upload-token-logos-to-ipfs.sh uses PINATA_JWT only (Bearer for pinFileToIPFS).
+PINATA_JWT=
+PINATA_API_KEY=
+PINATA_API_SECRET=
+
 # --- Blockchain / SMOM-DBIS-138 (use smom-dbis-138/.env for PRIVATE_KEY) ---
 PRIVATE_KEY=
 RPC_URL_138=
 RPC_URL_138_PUBLIC=
+# Ethereum L1 — used for dual-anchor attestation with scripts/omnl/omnl-chain138-attestation-tx.sh (consumes ETH gas). Alias: RPC_URL_MAINNET.
 ETHEREUM_MAINNET_RPC=
 CHAIN_651940_RPC_URL=
 ETHERLINK_RPC_URL=
@@ -122,6 +134,51 @@ MOONPAY_SECRET_KEY=
 RAMP_NETWORK_API_KEY=
 ONRAMPER_API_KEY=
 
+# --- GRU Transport / cW hard-peg bridge controls (Chain 138 -> public chains) ---
+# Canonical L1 bridge env used by the GRU transport overlay and token-aggregation.
+CHAIN138_L1_BRIDGE=
+# Legacy alias still used by some deployment helpers.
+CW_L1_BRIDGE_CHAIN138=
+CW_BRIDGE_MAINNET=
+CW_BRIDGE_CRONOS=
+CW_BRIDGE_BSC=
+CW_BRIDGE_POLYGON=
+CW_BRIDGE_GNOSIS=
+CW_BRIDGE_AVALANCHE=
+CW_BRIDGE_BASE=
+CW_BRIDGE_ARBITRUM=
+CW_BRIDGE_OPTIMISM=
+CW_RESERVE_VERIFIER_CHAIN138=
+CW_STABLECOIN_RESERVE_VAULT=
+CW_RESERVE_SYSTEM=
+CW_ATTACH_VERIFIER_TO_L1=1
+CW_REQUIRE_VAULT_BACKING=
+CW_REQUIRE_RESERVE_SYSTEM_BALANCE=
+CW_REQUIRE_TOKEN_OWNER_MATCH_VAULT=
+CW_CANONICAL_USDT=
+CW_CANONICAL_USDC=
+CW_USDT_RESERVE_ASSET=
+CW_USDC_RESERVE_ASSET=
+CW_MAX_OUTSTANDING_USDT_MAINNET=
+CW_MAX_OUTSTANDING_USDC_MAINNET=
+CW_MAX_OUTSTANDING_USDT_CRONOS=
+CW_MAX_OUTSTANDING_USDC_CRONOS=
+CW_MAX_OUTSTANDING_USDT_BSC=
+CW_MAX_OUTSTANDING_USDC_BSC=
+CW_MAX_OUTSTANDING_USDT_POLYGON=
+CW_MAX_OUTSTANDING_USDC_POLYGON=
+CW_MAX_OUTSTANDING_USDT_GNOSIS=
+CW_MAX_OUTSTANDING_USDC_GNOSIS=
+CW_MAX_OUTSTANDING_USDT_AVALANCHE=
+CW_MAX_OUTSTANDING_USDC_AVALANCHE=
+CW_MAX_OUTSTANDING_USDT_BASE=
+CW_MAX_OUTSTANDING_USDC_BASE=
+CW_MAX_OUTSTANDING_USDT_ARBITRUM=
+CW_MAX_OUTSTANDING_USDC_ARBITRUM=
+CW_MAX_OUTSTANDING_USDT_OPTIMISM=
+CW_MAX_OUTSTANDING_USDC_OPTIMISM=
+CW_FREEZE_AVAX_L2_CONFIG=
+
 # --- Alerts & monitoring ---
 SLACK_WEBHOOK_URL=
 PAGERDUTY_INTEGRATION_KEY=
@@ -129,6 +186,17 @@ EMAIL_ALERT_API_URL=
 EMAIL_ALERT_RECIPIENTS=
 SENTRY_DSN=
 
+# --- dbis_core IRU / marketplace outbound mail (optional; Proxmox Mail Proxy VMID 100 = 192.168.11.32) ---
+# EMAIL_PROVIDER=smtp
+# SMTP_HOST=192.168.11.32
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=
+# SMTP_PASSWORD=
+# EMAIL_FROM=
+# EMAIL_FROM_NAME=SolaceNet
+# DBIS_SALES_EMAIL=
+
 # --- Legal / e-signature ---
 E_SIGNATURE_BASE_URL=