feat(learning): add scenario attempt telemetry and curriculum completion rules

Evolves scenario_attempts (Phase 2B: one row per validation click) into a real attempt
lifecycle — one row per continuous working session, with live counters (validation
attempts/passes/fails, hint reveals, duration) updated in place, not re-inserted. Backward
compatible: every new column is nullable/defaulted, existing rows backfilled under the new
semantics rather than dropped. hint_count (Phase 2B, always NULL — 'not measurable') finally
gets a real DEFAULT 0 and increments, since this is the phase that builds real hint tracking.

curriculum-rules.js computes rule-driven stage lock/complete/percent/next-scenario state from
scenarios/rootnode-path.json's new per-stage completion_rule (all_required/threshold/
prerequisites) against a student's progress. The capstone stage is no longer a hardcoded
locked placeholder — it carries an unlock_rule and a pointer at the assessment definition that
actually defines its scenario draw (see the assessment-engine commit).

scenarios/rootnode-path.json

@@ -2,11 +2,13 @@
   "id": "rootnode-path",
   "name": "RootNode Learning Path",
   "tagline": "The guided route through RootNode Academy — one stage at a time.",
+  "version": 1,
   "stages": [
     {
       "id": "foundation",
       "name": "Foundation",
       "icon": "🌱",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "pod-basics-mcq",
         "kubectl-essentials-mcq",
@@ -34,6 +36,7 @@
       "id": "workloads",
       "name": "Workloads",
       "icon": "📦",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "deploy-nginx",
         "scale-deployment",
@@ -49,6 +52,7 @@
       "id": "networking",
       "name": "Networking",
       "icon": "🔌",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "services-mcq",
         "expose-service-basics"
@@ -58,6 +62,7 @@
       "id": "configuration",
       "name": "Configuration",
       "icon": "⚙️",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "configmap-volume",
         "resource-limits-task",
@@ -70,6 +75,7 @@
       "id": "troubleshooting",
       "name": "Troubleshooting",
       "icon": "🔍",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "extract-logs-basics",
         "kubectl-cp-basics",
@@ -83,6 +89,7 @@
       "name": "RootNode: Real Ops",
       "icon": "🌳",
       "bundle_id": "rootnode-real-ops",
+      "completion_rule": { "type": "all_required" },
       "scenario_ids": [
         "rootnode-runaway-monitor",
         "broken-deployment",
@@ -94,7 +101,9 @@
       "id": "capstone",
       "name": "Capstone",
       "icon": "🏁",
-      "locked": true,
+      "type": "capstone",
+      "capstone_assessment_id": "rootnode-capstone",
+      "unlock_rule": { "type": "stages_complete", "stage_ids": ["foundation", "workloads", "networking", "configuration", "troubleshooting", "real-ops"] },
       "scenario_ids": []
     }
   ]