Use python3 as the canonical command name course-wide (#104)

Most current systems (default Debian/Ubuntu, recent macOS) install Python
only as `python3`, with no bare `python` on PATH, so learners who copied
`python cli.py ...` into their host shell hit "command not found".

Convert host-shell `python <cmd>` -> `python3 <cmd>` across module/lab
READMEs, lab `.py` docstrings & usage strings, blog posts, lab prompt and
instruction files, the M04 verify.sh message, and the M10/M24 lab patches.
Module 01's convention note (and its blog/02 mirror) is rewritten so
`python3` is canonical and `python` is the documented fallback.

Stop-lines respected: Docker image tags (`python:3.12-slim`), `.venv/.../python`
and `...\.venv\Scripts\python.exe` paths, the M20 `"command": "python"`
teaching example and surrounding venv prose, container-internal invocations
(M16/M18 Dockerfiles, M16 README `docker run` examples), and CI-workflow
`run:` steps fed by `actions/setup-python` / `image: python:3.12` are left
as `python` on purpose.

pip was left out of scope: most occurrences are prose or CI/container-internal,
and `pip3` does not fix the PEP 668 externally-managed-environment refusal that
the course already addresses with venvs. The M01 note is worded to stay
consistent with bare `pip` (use whichever pip pairs with your Python).

Build (tools/build_wiki.py) and tools/check.sh both pass.

Closes #104

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GAEzanEoGJT5o1VizQar47

modules/17-secrets-config-and-environments/README.md

@@ -90,10 +90,10 @@ Set one for a single command:
 
 ```bash
 # macOS / Linux
-TASKS_API_KEY="sk-live-..." python sync.py
+TASKS_API_KEY="sk-live-..." python3 sync.py
 
 # Windows PowerShell
-$env:TASKS_API_KEY="sk-live-..."; python sync.py
+$env:TASKS_API_KEY="sk-live-..."; python3 sync.py
 ```
 
 Read it back in code, and **fail loudly if it's missing**, because a silent empty string is worse
@@ -307,7 +307,7 @@ type the commands by hand. Then you'll make it select config per environment.
 
    ```bash
    cd ~/ai-workflow-course/tasks-app
-   python sync.py
+   python3 sync.py
    ```
 
    It prints a simulated request, including `Authorization: Bearer sk-live-...`. Open `sync.py` and
@@ -407,7 +407,7 @@ type the commands by hand. Then you'll make it select config per environment.
 5. Run it reading from your `.env`:
 
    ```bash
-   python sync.py                # loads .env -> dev URL, key from the file
+   python3 sync.py                # loads .env -> dev URL, key from the file
    ```
 
 6. Now prove the 12-factor point: **same code, different environment, no edit.** Override at the
@@ -415,13 +415,13 @@ type the commands by hand. Then you'll make it select config per environment.
 
    ```bash
    # macOS / Linux
-   APP_ENV=staging python sync.py
-   APP_ENV=prod    TASKS_API_KEY="sk-live-prod-key" python sync.py
+   APP_ENV=staging python3 sync.py
+   APP_ENV=prod    TASKS_API_KEY="sk-live-prod-key" python3 sync.py
    ```
 
    ```powershell
    # Windows PowerShell
-   $env:APP_ENV="staging"; python sync.py
+   $env:APP_ENV="staging"; python3 sync.py
    ```
 
    Watch the backend URL change with `APP_ENV` while the source never does. That's config in the
@@ -483,7 +483,7 @@ left behind a `.env.example` so the next person (or agent) knows what to supply.
 - `sync.py` runs entirely from the environment, and `grep "sk-live" sync.py` prints nothing.
 - A real `.env` exists, contains your secret, and does **not** appear in `git status`, while
   `.env.example` is tracked.
-- `APP_ENV=staging python sync.py` and the default run hit different backend URLs with **zero**
+- `APP_ENV=staging python3 sync.py` and the default run hit different backend URLs with **zero**
   source edits between them.
 - You can state, in one sentence, why deleting a committed secret and re-committing does not fix the
   leak, and what the actual fix is (rotation).