feat: enforce terminal-before-gh and credentials-before-run ordering constraints

[Copilot]

Two ordering bugs in the workshop simulator: gh/gh-aw could be installed before any terminal was open, and workflows could run without agent credentials ever being configured.

Simulator state (simulator.js)

• Added environmentReady: false and agentCredentialsConfigured: false to default flags

Journey transitions (workshop-student-journey.js)

• 02-setup — sets flags.environmentReady = true after OS/terminal validation passes
• 06-install-gh-aw — gates on flags.environmentReady (new environment-not-ready failure category); sets flags.agentCredentialsConfigured = true when auth.isLoggedIn
• 08-run-workflow — new ensure check on flags.agentCredentialsConfigured (new agent-credentials-missing failure category)

// 06-install-gh-aw now fails fast if no terminal/codespace:
ensure(state.flags.environmentReady, "gh CLI cannot be installed before a Codespace or local terminal is open", ...)

// 08-run-workflow now requires credentials set during install:
ensure(state.flags.agentCredentialsConfigured, "Agent credentials have not been configured", ...)

Authoring guidelines (guidelines.md)

• New Section 5 codifies both constraints: no gh install before environment setup, and credential configuration must precede the run step.