fix(modules-12,14,15,18,19,25): editor note, refresh CI action pins, scaffold M15 merge

- M12: note the editor that `git revert -m 1 HEAD` opens (save/close, or --no-edit);
  the -m 1 / --no-ff merge teaching is unchanged.
- Refresh stale CI action pins to verified-current majors (actions/checkout @v4->@v7,
  actions/setup-python @v5->@v6; confirmed via GitHub Releases, 2026-06) across
  M14/M15/M18/M19/M25; add a Verify-before-publish item for pinned action versions.
- M15: scaffold the "slot security steps into the workflow" YAML merge (before/after
  diff, indentation caution, copy-whole-job alternative). Planted devices intact.

Closes #43
Closes #44
Closes #50

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/15-security-scanning/lab/ci-security.yml

@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest   # or your self-hosted runner label (Module 19)
     steps:
       - name: Check out the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         # Secret scanning cares about history. If your tool scans commits (not just the working
         # tree), fetch full history here — e.g. set `with: { fetch-depth: 0 }`.
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.x"