Harden StormDNS boundary guard

[AmirrezaFarnamTaheri]

Summary

• Validate both base and head refs before checking StormDNS boundary changes.
• Guard .gitmodules alongside third_party/StormDNS because submodule metadata changes affect the upstream engine boundary.
• Stop masking git diff failures in the boundary script.
• Let allow-stormdns-upstream bypass only intentional upstream-change detections, not script/ref failures.
• Update the upstream policy doc to include guarded submodule metadata.

Verification

• git diff --check
• conflict-marker search across tracked text files
• boundary guard success path with identical refs
• boundary guard invalid-head-ref path returns exit 2
• sequential merge simulation with PRs Improve setup readiness, presets, traffic clarity, and diagnostics #35, Improve resolver scan intelligence and budget controls #36, Improve runtime launch and proxy bridge safety #39, and Harden StormDNS boundary guard #40