feat: add incident operation chains and basic pipeline support

COURSE_TASKS.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "version": "4.1",
+    "version": "4.2",
     "title": "Linux 系统学习课程（运维全场景版）",
     "author": "OpenClaw Dev",
     "updated": "2026-03-10",
@@ -1952,6 +1952,50 @@
               "type": "scenario",
               "question": "如果端口没监听，你下一步更应该看什么？",
               "answer": "看服务状态和日志，确认是否启动失败或启动后立即退出"
+            },
+            {
+              "id": "m10_l1_service_down_op1",
+              "type": "operation",
+              "title": "第一步：确认服务状态",
+              "hint": "systemctl status nginx",
+              "success_test": "cmd == 'systemctl status nginx'",
+              "solution": [
+                "systemctl status nginx"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l1_service_down_op2",
+              "type": "operation",
+              "title": "第二步：确认端口监听",
+              "hint": "ss -ltnp | grep 80",
+              "success_test": "'80' in output",
+              "solution": [
+                "ss -ltnp | grep 80"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l1_service_down_op3",
+              "type": "operation",
+              "title": "第三步：看最近日志",
+              "hint": "journalctl -u nginx -n 50",
+              "success_test": "'Started' in output or 'connect() failed' in output",
+              "solution": [
+                "journalctl -u nginx -n 50"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l1_service_down_op4",
+              "type": "operation",
+              "title": "第四步：本机请求验证",
+              "hint": "curl -I http://127.0.0.1",
+              "success_test": "'hello' in output or '200' in output or 'html' in output",
+              "solution": [
+                "curl -I http://127.0.0.1"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
             }
           ],
           "related_commands": [
@@ -2024,6 +2068,39 @@
               "type": "scenario",
               "question": "如果 /var/log 特别大，你会想到哪些命令组合？",
               "answer": "df、du、find、sort 组合起来定位大文件和大目录"
+            },
+            {
+              "id": "m10_l2_disk_full_op1",
+              "type": "operation",
+              "title": "第一步：确认哪个挂载点满了",
+              "hint": "df -h",
+              "success_test": "'Filesystem' in output",
+              "solution": [
+                "df -h"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l2_disk_full_op2",
+              "type": "operation",
+              "title": "第二步：定位大目录（示例：/var/log）",
+              "hint": "du -sh /var/log",
+              "success_test": "'/var/log' in output",
+              "solution": [
+                "du -sh /var/log"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l2_disk_full_op3",
+              "type": "operation",
+              "title": "第三步：找日志相关文件（示例）",
+              "hint": "find /var/log -type f",
+              "success_test": "'/var/log' in output",
+              "solution": [
+                "find /var/log -type f"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
             }
           ],
           "related_commands": [
@@ -2094,6 +2171,39 @@
               "type": "scenario",
               "question": "如果脚本明明存在却执行不了，你会从哪几类信息开始看？",
               "answer": "先看 whoami/id，再看文件权限和属主属组，必要时看相关日志"
+            },
+            {
+              "id": "m10_l3_login_fail_op1",
+              "type": "operation",
+              "title": "第一步：确认当前身份",
+              "hint": "id",
+              "success_test": "'uid=' in output",
+              "solution": [
+                "id"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l3_login_fail_op2",
+              "type": "operation",
+              "title": "第二步：查看认证日志尾部",
+              "hint": "cat /var/log/auth.log | tail -n 1",
+              "success_test": "'sshd' in output",
+              "solution": [
+                "cat /var/log/auth.log | tail -n 1"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
+            },
+            {
+              "id": "m10_l3_login_fail_op3",
+              "type": "operation",
+              "title": "第三步：确认用户是否存在",
+              "hint": "grep sandbox_user /etc/passwd",
+              "success_test": "'sandbox_user' in output",
+              "solution": [
+                "grep sandbox_user /etc/passwd"
+              ],
+              "success_msg": "✅ 通过：继续下一步"
             }
           ],
           "related_commands": [