fix(testing/ci/tooling): consistent unittest, venv guidance, runnable lab commands

- #9: standardize the test chain on stdlib unittest (nothing-to-install, which
  keeps M13's claims true and its planted bug intact). Aligned M5/M14/M16 prose,
  M14 lab/test_tasks.py, and ci/gitlab starters; ruff stays the only pip install.
- #20: add venv / PEP 668 / which-python guidance to M20 (+ M14/M15 local
  installs); point MCP config at the venv's absolute python.
- #21: replace M21 Part D's empty `git diff HEAD~1` with `git log -p` (no
  .gitignore added — device preserved).
- #22: add a dependency-install step before M23's green baseline on a fresh clone.
- #23: M24 reviewer/triage now tolerate code-fence-wrapped JSON (stdlib only);
  feature.patch trap untouched.
- #28: fix M27 Part D CI snippet path (working-directory) and require the gate to
  target a varying candidate; swapped_model regression kept as the fixture.

Closes #9
Closes #20
Closes #21
Closes #22
Closes #23
Closes #28

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT

modules/15-security-scanning/README.md

@@ -220,6 +220,12 @@ and wire the catch into your pipeline.
   pip install pip-audit detect-secrets
   ```
 
+  > **If `pip install` is refused** with "externally-managed-environment" (PEP 668 — common on
+  > recent Debian/Ubuntu and Homebrew Python), install into a per-project virtual environment
+  > instead: `python3 -m venv .venv && source .venv/bin/activate` (Windows: `.venv\Scripts\activate`),
+  > then re-run the install. (`pipx` or `pip install --break-system-packages` also work; a venv is the
+  > clean default.)
+
   These are concrete, currently-maintained examples of the **SCA** and **secret-scanning**
   categories — not the only choices (see *Where it breaks* and *Verify-before-publish*). The lab
   teaches the moves; the moves transfer to any tool in the category.