CLUBB advected-moments read loop runs one level past state%q (out-of-bounds) in clubb_intr.F90

## Summary

With `clubb_do_adv = .true.`, the loop that reads the 9 advected CLUBB moments out of `state%q` runs one level too far, reading past the end of `state%q` and writing past the end of a `nzt_clubb`-sized pbuf field.

## Location

`src/physics/cam/clubb_intr.F90:3098-3111` (registrations at line 633; writeback at 4284-4314)

## Problem

The read loop runs `k = 1, nzm_clubb`, so `k_cam` reaches `pverp`, but `state%q` has only `pver` levels — an out-of-bounds read for all nine moments. It is also an out-of-bounds **write** for `wp3_pbuf`, which is registered with only `nzt_clubb` levels, corrupting the adjacent pbuf field. The corresponding writeback loop covers only `nzt_clubb` levels, confirming the read-loop bound is the one that is wrong.

## Impact

Garbage surface-level turbulence moments entering CLUBB each substep, plus corruption of a neighboring physics-buffer field, whenever CLUBB moment advection is enabled. Affects prognostic state.

## Suggested fix

```fortran
do k = 1, nzt_clubb
```

---
_Found via a systematic line-by-line scientific code review of `src/physics/cam/` at commit `21a78294` (≈cam6_4_180), cross-checked against the registration and writeback bounds. This is a candidate bug identified by code inspection; it has not yet been confirmed by a model run. An issue-tracker search on 2026-06-11 found no existing report._