fix(modules-2,6,7,8,9,10,14): deterministic main branch + correct two claims

- M2 lab now `git init -b main` (with older-git fallback note) so every later
  `main` reference resolves; reconciled M3/M6/M7/M8 wording and M10's standalone
  review-lab repo (`git init -qb main`).
- M9: replace "issues are on by default on every forge" with a provider-neutral
  version naming the exceptions (Bitbucket/Azure DevOps/SourceHut).
- M14: qualify "hosted runners need zero setup" — true for SaaS forges; the
  self-hosted track needs a runner attached (Module 19). Both paths stay valid.

Closes #5
Closes #13
Closes #16

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/14-continuous-integration/README.md

@@ -17,7 +17,12 @@
 - **Module 2 — Version Control.** Pushes, commits, and the diff habit are the substrate CI sits on.
 
 You do **not** need Docker, secrets management, or your own runner yet — those are Modules 16, 17,
-and 19. This module uses the forge's hosted runners, which require zero setup.
+and 19. On a **SaaS forge** (GitHub, GitLab.com, Bitbucket, and the rest) this module uses the
+forge's hosted runners, which require zero setup. **One honesty note for the self-host track:** a
+self-hosted Forgejo/Gitea/GitLab CE has the CI *feature* but no hosted compute — nothing actually
+runs until you attach a runner, and that's Module 19. The workflow you write here is correct either
+way and will run the moment a runner is registered; to watch it go green *now*, use a SaaS forge's
+hosted runners, then come back and own the compute end-to-end in Module 19.
 
 ---
 
@@ -245,7 +250,10 @@ your machine first.
 
 4. Open your repo in the forge's web UI and find the run (usually an "Actions," "CI/CD," or
    "Pipelines" tab, and a status icon on the commit). Watch the steps execute and turn green.
-   **That green check is the gate now standing guard on every future push.**
+   **That green check is the gate now standing guard on every future push.** (Self-host track: if
+   the run sits queued with nothing picking it up, that's the no-hosted-runner situation from the
+   prerequisites — the workflow is correct, it just has no compute until you attach a runner in
+   Module 19. Run this part on a SaaS forge to see green here and now.)
 
 ### Part C — Break it on purpose and watch CI catch it