fix(api): constrain disposition_overrides keys; close docker paper cuts

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

api/tests/test_content_resolution.py

@@ -38,3 +38,10 @@ def test_null_quest_ref_resolves():
     origin = copy.deepcopy(load_origin(DESERTER))
     origin["start_quest_id"] = None
     assert unresolved_refs(origin, world) == []
+
+
+def test_broken_disposition_npc_ref_is_detected():
+    world = load_world(CONTENT_ROOT)
+    origin = copy.deepcopy(load_origin(DESERTER))
+    origin["disposition_overrides"]["ghost_npc"] = 10
+    assert "npc:ghost_npc" in unresolved_refs(origin, world)

api/tests/test_origin_schema.py

@@ -46,3 +46,9 @@ def test_extra_field_is_rejected():
     doc = copy.deepcopy(VALID_ORIGIN)
     doc["surprise"] = True
     assert validate_origin(doc) != []
+
+
+def test_disposition_override_key_must_match_id_pattern():
+    doc = copy.deepcopy(VALID_ORIGIN)
+    doc["disposition_overrides"] = {"Brannoc Thane": 40}
+    assert validate_origin(doc) != []