Sync workspace: config, docs, scripts, CI, operator rules, and submodule pointers.

- Update dbis_core, cross-chain-pmm-lps, explorer-monorepo, metamask-integration, pr-workspace/chains
- Omit embedded publish git dirs and empty placeholders from index

Made-with: Cursor

scripts/operator/README.md

@@ -0,0 +1,14 @@
+# Operator scripts — scope classes
+
+Scripts here touch **live Proxmox / edge** systems. Prefer **narrow scope** and **dry-run first**.
+
+| Script | Class | Notes |
+|--------|-------|--------|
+| `start-stopped-lxc-scoped.sh` | **Scoped mutate** | Requires `--host` + `--vmid` (repeat); default dry-run; `--apply` or `PROXMOX_OPS_APPLY=1` to run `pct start`. |
+| `upgrade-gitea-lxc.sh` | Scoped | Use `--dry-run` per script header. |
+
+**Shared helpers:** `scripts/lib/proxmox-production-guard.sh` — `PROXMOX_OPS_APPLY`, `PROXMOX_OPS_ALLOWED_VMIDS`, `PROXMOX_SAFE_DEFAULTS`.
+
+**Broad orchestration** (multiple subsystems) remains in `scripts/run-all-operator-tasks-from-lan.sh` and `scripts/maintenance/run-all-maintenance-via-proxmox-ssh.sh` — review `--dry-run` before running on production.
+
+See also: `AGENTS.md` (Production safety), `.cursor/rules/proxmox-production-safety.mdc`.