style(no-slop): remove every em-dash + banned words across all modules + capstone

Apply the no-ai-slop standard (now binding in AGENTS.md): the em-dash character is
banned outright (restructured, not blind-replaced), plus the banned word/phrase
list (delve, leverage, robust, seamless, truly, unlock, etc.). 0 em-dashes remain
in modules + capstone; the only "robust" left is the planted M10 ai-change.patch
trap. Module H1 titles use a colon separator.

All deliberate teaching devices preserved; labs compile/parse (py/sh/yaml/json);
no junk. AGENTS.md updated with the hard no-slop rules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/19-runners-the-compute-behind-automation/lab/whoami-runner.yml

@@ -1,4 +1,4 @@
-# Module 19 lab — "Where did this actually run?"
+# Module 19 lab: "Where did this actually run?"
 #
 # This is the Module 14 CI pipeline (lint + test the tasks-app) with one extra step bolted on the
 # end: it makes the runner tell you who and where it is. Run it once on a hosted runner, then again
@@ -6,7 +6,7 @@
 #
 # Where this file goes: the same workflow directory as your Module 14 ci.yml. On Actions-style forges
 # (GitHub, and Forgejo/Gitea with Actions-compatible YAML) that's <forge-dir>/workflows/ at the repo
-# root — e.g. .github/workflows/whoami-runner.yml. The filename is yours; the directory is not.
+# root, e.g. .github/workflows/whoami-runner.yml. The filename is yours; the directory is not.
 #
 # For GitLab CI, the same idea is a one-job .gitlab-ci.yml: run the same script lines under `script:`
 # with `tags:` selecting your runner. The shape rhymes; only the YAML dialect changes.
@@ -36,7 +36,7 @@ jobs:
       - name: Install tools
         run: pip install pytest ruff
 
-      # The real Module 14 checks still run — a self-hosted runner has to actually do the work.
+      # The real Module 14 checks still run; a self-hosted runner has to actually do the work.
       - name: Lint
         run: ruff check .
 
@@ -44,7 +44,7 @@ jobs:
         run: pytest -q
 
       # The point of THIS workflow: make the runner identify itself.
-      # if: always() so the receipt prints even when Lint/Test fail above — a diagnostic step
+      # if: always() so the receipt prints even when Lint/Test fail above; a diagnostic step
       # shouldn't vanish on a red build. The job still reports red; only this step is unconditional.
       # (On GitLab CI the same idea is `when: always` on the job/step.)
       - name: Where did this run?
@@ -69,9 +69,9 @@ jobs:
           echo
           echo "=== can this runner reach the public internet? ==="
           if curl -fsS -m 5 https://example.com >/dev/null 2>&1; then
-            echo "YES — outbound internet works from here."
+            echo "YES: outbound internet works from here."
           else
-            echo "NO — no outbound internet (could be an air-gapped / isolated runner)."
+            echo "NO: no outbound internet (could be an air-gapped / isolated runner)."
           fi
           echo
           echo "Now ask: is this machine MINE, and what else can it reach? (see inspect-runner.sh)"