Use python3 as the canonical command name course-wide (#104)

Most current systems (default Debian/Ubuntu, recent macOS) install Python
only as `python3`, with no bare `python` on PATH, so learners who copied
`python cli.py ...` into their host shell hit "command not found".

Convert host-shell `python <cmd>` -> `python3 <cmd>` across module/lab
READMEs, lab `.py` docstrings & usage strings, blog posts, lab prompt and
instruction files, the M04 verify.sh message, and the M10/M24 lab patches.
Module 01's convention note (and its blog/02 mirror) is rewritten so
`python3` is canonical and `python` is the documented fallback.

Stop-lines respected: Docker image tags (`python:3.12-slim`), `.venv/.../python`
and `...\.venv\Scripts\python.exe` paths, the M20 `"command": "python"`
teaching example and surrounding venv prose, container-internal invocations
(M16/M18 Dockerfiles, M16 README `docker run` examples), and CI-workflow
`run:` steps fed by `actions/setup-python` / `image: python:3.12` are left
as `python` on purpose.

pip was left out of scope: most occurrences are prose or CI/container-internal,
and `pip3` does not fix the PEP 668 externally-managed-environment refusal that
the course already addresses with venvs. The M01 note is worded to stay
consistent with bare `pip` (use whichever pip pairs with your Python).

Build (tools/build_wiki.py) and tools/check.sh both pass.

Closes #104

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GAEzanEoGJT5o1VizQar47

capstone/README.md

@@ -47,7 +47,7 @@ already standing; it doesn't re-pour the foundation.
 Pick something small enough to finish in one sitting and real enough to touch the whole stack. We'll
 add **due dates**:
 
-- A task can carry an optional due date: `python cli.py add "file taxes" --due <YYYY-MM-DD>`.
+- A task can carry an optional due date: `python3 cli.py add "file taxes" --due <YYYY-MM-DD>`.
 - A new `overdue` command lists pending tasks whose due date has already passed.
 - The deployed service grows a matching `GET /overdue` endpoint, so the change is visible in the
   running container, not just the CLI.
@@ -184,9 +184,9 @@ agent), your forge account, and a working Docker install.
    in the future, one safely in the past) so the assertion below holds whenever you run this:
 
    ```bash
-   python cli.py add "file taxes" --due <a date a few months out>   # future → NOT overdue
-   python cli.py add "renew domain" --due 2020-01-01                # past   → overdue
-   python cli.py overdue        # should list "renew domain", not "file taxes"
+   python3 cli.py add "file taxes" --due <a date a few months out>   # future → NOT overdue
+   python3 cli.py add "renew domain" --due 2020-01-01                # past   → overdue
+   python3 cli.py overdue        # should list "renew domain", not "file taxes"
    ```
 
    > *Verify-before-publish: refresh the example due dates so the "future" one is still in the future
@@ -199,7 +199,7 @@ agent), your forge account, and a working Docker install.
    them by name. Confirm the suite is green:
 
    ```bash
-   pytest        # or: python -m unittest
+   pytest        # or: python3 -m unittest
    ```
 
    Once it's green, tell the AI to commit the change. Then verify what it actually staged and wrote: