fix(verify): submodule check informational in check-completion-status

Default: show dirty submodule output as WARN without failing exit 1.
Set STRICT_SUBMODULE_CLEAN=1 for pre-release strict gate (submodules-clean).

Made-with: Cursor

scripts/verify/check-completion-status.sh

@@ -33,14 +33,28 @@ run_check() {
 section "Repo-Completable Checks"
 run_check "Config validation" bash scripts/validation/validate-config-files.sh
 run_check "All validation (--skip-genesis)" bash scripts/verify/run-all-validation.sh --skip-genesis
-run_check "Submodule working trees" env SKIP_EXIT=0 bash scripts/verify/submodules-clean.sh
+# Submodule WIP is common; enforce with STRICT_SUBMODULE_CLEAN=1 (e.g. pre-release).
+if [[ "${STRICT_SUBMODULE_CLEAN:-0}" == "1" ]]; then
+  run_check "Submodule working trees" bash scripts/verify/submodules-clean.sh
+else
+  printf -- '- %s\n' "Submodule working trees (informational; set STRICT_SUBMODULE_CLEAN=1 to fail)"
+  _sub_out="$(mktemp)"
+  if bash scripts/verify/submodules-clean.sh >"$_sub_out" 2>&1; then
+    printf '  [OK] Submodule working trees\n'
+    rm -f "$_sub_out"
+  else
+    cat "$_sub_out" >&2
+    rm -f "$_sub_out"
+    printf '  [WARN] Dirty submodule trees — commit inside each submodule, then parent pointer. See docs/00-meta/SUBMODULE_HYGIENE.md\n'
+  fi
+fi
 
 section "Public API Health"
 run_check "Public report API" env SKIP_EXIT=0 KEEP_GOING=1 bash scripts/verify/check-public-report-api.sh
 
 section "Status Interpretation"
 cat <<'EOF'
-- Repo-local validation is complete when the config, validation, and submodule checks pass.
+- Repo-local validation is complete when the config and validation checks pass. Submodule trees: informational here unless you set STRICT_SUBMODULE_CLEAN=1; use scripts/verify/submodules-clean.sh for a strict gate.
 - Public report API problems are usually operator-side nginx/proxy deployment issues, not repo code issues.
 - Remaining non-local work is tracked in:
   - docs/00-meta/STILL_NOT_DONE_EXECUTION_CHECKLIST.md