fix(running-example): consistent lab-script paths, tasks.json policy, no command collisions

- Lab-script path convention: course scripts live in modules/NN/lab/; copy the
  one a step needs into tasks-app, then run by bare name (M4/M6/M7/M26 + headers).
- tasks.json stays gitignored: M20 verifies via `cli.py list`/`cat tasks.json`
  (not git diff) and frames runtime state as deliberately ignored; M22 cleanup
  uses `rm tasks.json`; M10 review-lab gets its own .gitignore.
  Module 21's lab deliberately ships NO .gitignore (teaching device) — untouched.
- Stop running-example command collisions: M5 clear->search, M6 count/clear->
  stats/purge, M7 clear/count->wipe/remaining (README + scripts + agent prompts +
  branch/worktree names). M6 conflict still reproduces on the carried usage line.

Closes #7
Closes #10
Closes #11

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/22-securing-third-party-mcp-and-skills/README.md

@@ -294,10 +294,10 @@ normal question) and the attacker (you plant content the agent reads).
    # the tool it is NOT exposed (a write) — in a least-privilege setup this path is simply absent
    ```
 
-   Then clean up the planted task so your repo is honest again (Module 2):
+   Then clean up the planted state so your repo is honest again (Module 2):
 
    ```bash
-   git restore tasks.json      # or: python cli.py and delete it, then commit a clean state
+   rm tasks.json               # tasks.json is gitignored runtime state — nothing tracked to restore, so just delete it; the app recreates it empty on the next run
    ```
 
 ---