style(no-slop): remove every em-dash + banned words across all modules + capstone

Apply the no-ai-slop standard (now binding in AGENTS.md): the em-dash character is
banned outright (restructured, not blind-replaced), plus the banned word/phrase
list (delve, leverage, robust, seamless, truly, unlock, etc.). 0 em-dashes remain
in modules + capstone; the only "robust" left is the planted M10 ai-change.patch
trap. Module H1 titles use a colon separator.

All deliberate teaching devices preserved; labs compile/parse (py/sh/yaml/json);
no junk. AGENTS.md updated with the hard no-slop rules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/15-security-scanning/lab/ci-security.yml

@@ -1,4 +1,4 @@
-# ci-security.yml — the security gate as a CI step (Module 15).
+# ci-security.yml: the security gate as a CI step (Module 15).
 #
 # This is a PROVIDER-NEUTRAL snippet, not a drop-in file. The YAML below uses the widely-shared
 # "workflow / job / steps" shape that most hosted and self-hosted CI systems understand (the exact
@@ -24,7 +24,7 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@v7
         # Secret scanning cares about history. If your tool scans commits (not just the working
-        # tree), fetch full history here — e.g. set `with: { fetch-depth: 0 }`.
+        # tree), fetch full history here; e.g. set `with: { fetch-depth: 0 }`.
 
       - name: Set up Python
         uses: actions/setup-python@v6