docs(ops): submodule hygiene guide, verify script, rule/doc alignment

- Add docs/00-meta/SUBMODULE_HYGIENE.md (detached HEAD, remotes, JSON refs)
- Add scripts/verify/submodules-clean.sh (labeled dirty-tree report)
- AGENTS.md + CONTRIBUTOR_GUIDELINES + OPERATOR_READY_CHECKLIST + MASTER_INDEX
- chain138-tokens-and-pmm: DODOPMMIntegration 0x5BDc62… per ADDRESS_MATRIX
- Bump smom-dbis-138 + explorer-monorepo (config READMEs, explorer env loading)

Made-with: Cursor

scripts/verify/submodules-clean.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Exit 0 if every submodule has a clean working tree (no modified/untracked files).
+# Use in CI or after merges: bash scripts/verify/submodules-clean.sh
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+
+dirty=0
+while IFS= read -r subpath; do
+  [[ -z "$subpath" ]] && continue
+  if ! git -C "$ROOT/$subpath" rev-parse --git-dir >/dev/null 2>&1; then
+    continue
+  fi
+  out="$(git -C "$ROOT/$subpath" status --porcelain 2>/dev/null || true)"
+  if [[ -n "$out" ]]; then
+    dirty=1
+    printf '%s\n' "=== $subpath ===" >>"$tmp"
+    printf '%s\n' "$out" >>"$tmp"
+  fi
+done < <(git config --file .gitmodules --get-regexp '^submodule\..*\.path$' | awk '{print $2}' | sort -u)
+
+if (( dirty )); then
+  echo "submodules-clean: dirty submodule working trees:" >&2
+  cat "$tmp" >&2
+  exit 1
+fi
+
+echo "submodules-clean: OK (all submodules clean)"