style(no-slop): remove every em-dash + banned words across all modules + capstone

Apply the no-ai-slop standard (now binding in AGENTS.md): the em-dash character is
banned outright (restructured, not blind-replaced), plus the banned word/phrase
list (delve, leverage, robust, seamless, truly, unlock, etc.). 0 em-dashes remain
in modules + capstone; the only "robust" left is the planted M10 ai-change.patch
trap. Module H1 titles use a colon separator.

All deliberate teaching devices preserved; labs compile/parse (py/sh/yaml/json);
no junk. AGENTS.md updated with the hard no-slop rules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/16-containers-and-reproducible-environments/lab/Dockerfile

@@ -1,11 +1,11 @@
-# Dockerfile for the tasks-app — a reproducible environment you can build, run, and throw away.
+# Dockerfile for the tasks-app: a reproducible environment you can build, run, and throw away.
 #
 # Build it:   docker build -t tasks-app .
 # Run it:     docker run --rm tasks-app list
 #             docker run --rm tasks-app add "containerize the app"
 #
 # The same image runs identically on your laptop, on the CI runner (Module 14), and on a deploy
-# target (Module 18) — because the environment travels *inside the image* instead of living only
+# target (Module 18), because the environment travels *inside the image* instead of living only
 # in your head. (Docker is the worked example here; this is a standard OCI image, so `podman build`
 # / `nerdctl build` read the same file.)
 
@@ -21,15 +21,15 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1
 
 # --- App --------------------------------------------------------------------
-# Everything lives in /app inside the image. This path is identical on every machine that runs it —
+# Everything lives in /app inside the image. This path is identical on every machine that runs it;
 # that sameness is the whole point.
 WORKDIR /app
 
-# Copy the app in. .dockerignore (see dockerignore-starter in this folder) keeps junk — caches,
-# runtime state, the .git dir — out of the build and out of the image.
+# Copy the app in. .dockerignore (see dockerignore-starter in this folder) keeps junk (caches,
+# runtime state, the .git dir) out of the build and out of the image.
 COPY tasks.py cli.py ./
 
-# Run as a non-root user. This is hygiene, NOT a security boundary on its own — see the README's
+# Run as a non-root user. This is hygiene, NOT a security boundary on its own; see the README's
 # "Where it breaks." We also hand /app to that user so the app can write tasks.json at runtime.
 RUN useradd --create-home appuser && chown appuser /app
 USER appuser

modules/16-containers-and-reproducible-environments/lab/dockerignore-starter

@@ -4,19 +4,19 @@
 # bloat the image, slow the build, or leak into it. A lean, predictable build context is part of
 # what makes the image reproducible.
 
-# Python caches — regenerated, never shipped
+# Python caches: regenerated, never shipped
 __pycache__/
 *.pyc
 
-# Runtime state — never bake one machine's data into a shared image
+# Runtime state: never bake one machine's data into a shared image
 tasks.json
 
-# Version control and project meta — not needed to run the app
+# Version control and project meta: not needed to run the app
 .git/
 .gitignore
 .dockerignore
 
-# Local environments and docs — keep them out of the image
+# Local environments and docs: keep them out of the image
 .venv/
 venv/
 *.md