fix(modules-16,18,19,20): runner receipt on red, runnable M20 Part A, container caveats

- M19: `if: always()` on the "where did this run?" receipt step only (GitLab
  when: always noted) so it prints even when lint/test fail; real steps unchanged.
- M20: mark Part A optional with its runtime prereq (npx/Node or uvx/uv) named;
  Part B/C (Python SDK) carry the load-bearing path. Reconciled objectives/checks.
- M16: native-Linux bind-mount caveat (root-owned __pycache__; PYTHONDONTWRITEBYTECODE).
- M16/M18: prerequisite that the container engine/daemon must be RUNNING
  (docker --version is false reassurance; docker info; podman machine start).

Closes #41
Closes #42
Closes #45
Closes #46

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/19-runners-the-compute-behind-automation/README.md

@@ -222,7 +222,9 @@ a repo also works). If a real runner is too heavy right now, Track A alone satis
    (the same place your Module 14 `ci.yml` lives — for Actions-style forges that's
    `.github/`/`.forgejo/`/`.gitea/` under `workflows/`; the file comments tell you where). Commit and
    push. It runs the same lint-and-test as Module 14, then prints the runner's hostname, OS, user,
-   whether it looks ephemeral, and whether it can reach the public internet.
+   whether it looks ephemeral, and whether it can reach the public internet. The receipt step carries
+   `if: always()` so it still prints even when lint or test fail — a diagnostic shouldn't disappear on
+   a red build (the job still reports red). On GitLab CI the same idea is `when: always` on the job.
 
 2. **Read the receipt.** Open the job logs on your forge and read the `Where did this run?` step.
    You're now able to answer, for a real job, the question this module opened with: *whose computer

modules/19-runners-the-compute-behind-automation/lab/whoami-runner.yml

@@ -44,7 +44,11 @@ jobs:
         run: pytest -q
 
       # The point of THIS workflow: make the runner identify itself.
+      # if: always() so the receipt prints even when Lint/Test fail above — a diagnostic step
+      # shouldn't vanish on a red build. The job still reports red; only this step is unconditional.
+      # (On GitLab CI the same idea is `when: always` on the job/step.)
       - name: Where did this run?
+        if: always()
         shell: bash
         run: |
           echo "=== runner identity ==="