GeezerVison

Summary

This PR adds the three courses chosen from the learner-demand research. All three are bilingual (EN+ZH) and meet the course contract.

Integration:

• The foundation path gains Copilot as a seventh first-agent module (m3e), and later module order values shift by one.
• The orientation and route-challenge modules (EN+ZH) now list seven tools.
• llms.txt, both READMEs, and paths/README*.md list the new courses.
• tests/test_courses.py, content-manifest.json, course-solutions.json, and the CHANGELOG [Unreleased] section are updated.

Stacked on #106, so the base is cursor/release-0-1-2-21e9. Retarget to master once #106 merges.

Change type

• Catalog resource or classification
• Bilingual editorial content
• Catalog export or consumer contract
• Tests, tooling, or workflow
• Governance or documentation

Evidence and scope

• Related issue: learner-demand research for new courses (no issue filed).
• Source or maintenance evidence:
  • Copilot: the course is written from the VS Code Copilot docs fetched 2026-10-11.
  • Security: the course draws on the Python stdlib docs, MITRE CWE-89/22/798/916/759/502, and the OWASP Password Storage Cheat Sheet.
  • Solvability: each topic course's REVIEW.md records a challenge-mode run, in which an agent solved it from TASK.md and the tests without solution/. Those runs led to these changes:
    • Clarified the fallback attempts value and the max_tool_calls rules, and added test_tool_call_budget_ends_in_the_fallback.
    • Clarified the iteration-count split and the session-token separator.
    • Fixed a TypeError that the security reference solution raised on non-ASCII session tokens.
    • Corrected the verify.py exit-rule wording in the three new COURSE.md files.
• Website consumer impact: none until a deliberate pin bump. The website hand-mirrors course metadata (courses.ts / COURSE_CONTRACTS), so those entries and the shifted foundation-path orders need updating before the pin moves.
• Intentionally out of scope:
  • Agent-taught run-throughs are pending for all three courses (recorded in each REVIEW.md). Nothing has been run inside VS Code with Copilot.
  • Older courses: their COURSE.md files still say verify.py exits non-zero "while l03/l04 are open"; it actually stays non-zero until l01/l02/l05 are attested too. Left untouched here.

Validation

• python -m pytest: 141 passed (via make check)
• python tools/validate_catalog.py (via make check)
• python tools/export_catalog.py --check --target both: current
• python tools/render_readmes.py --check: current
• python tools/build_content_manifest.py --check: current
• python tools/verify_examples.py: all 5 valid
• python tools/verify_courses.py: all 15 course folders satisfy the contract
• python tools/verify_paths.py: 2 paths verified
• make lock-check: exit 0
• Per course: verify.py starter --expect-failure and verify.py solution both exit 0, and bare verify.py exits 1 on the shipped starter.
• Replay and eval results:
  • Security replay: blocked=9/9 and 8/8 on the solution, 0/9 and 0/8 on the starter. Ruff --select S is clean on the solution.
  • LLM eval on the solution: 0.750 (exit 1), 0.833, 0.800.
• English and Chinese output remain consistent
• No secrets, generated reports, local build output, or analytics IDs were committed. The secrets.txt files are fake scenario fixtures.

Permissions and review

• I have the right to submit this contribution.
• I retained third-party notices and did not relicense third-party material.
• Human reviewers wrote or verified all resource descriptions and classifications. No catalog resources changed; the course text still needs maintainer review.
• I read CONTRIBUTING.md and docs/CURATION_POLICY.md.