Milestone 6: resolve governed lesson media

[botsarefuture]

Purpose

Make governed published media usable by learner-facing lessons without sacrificing deterministic revisions or resilient bundled fallback.

What changed

• adds exact lesson assetRef pins using asset id, version, and locale
• retains every immutable published media revision in the public manifest
• resolves only exact, kind-matched, fully reviewed assets
• applies governed sources and accessibility alternatives while preserving bundled fallback
• adds structured asset-reference fields to lesson authoring
• pins the real Foundations pathway illustration
• aligns delivery sources with the same-origin content-security policy
• serves HTML with no-cache so deployments discover new hashed bundles while manifests remain cacheable

Validation

• npm test (32 tests)
• PYTHONPATH=server python3 -m unittest discover -s server -p "test_*.py" (21 tests)
• npm run build
• npm run check:version
• staging author → reviewer → publisher publication of the real “How voice learning works” lesson and a Foundations course
• learner rendering of governed media accessibility metadata on desktop and 390px mobile with no overflow
• exact v1 pin remains v1 when v2 exists; missing, mismatched, and incompletely reviewed assets retain bundled media
• verified HTML Cache-Control: no-cache and media public, max-age=300, stale-while-revalidate=3600

Known limitation

Real localized teaching media and binary upload/storage remain later Milestone 6 slices.