fix(content-build): --check orphan detection; canon secrecy-0 + value-type guards

- --check now detects orphaned/stale build artifacts in build-owned dirs
  (client canon/ + topics/ fully owned; client npcs/ shared with legacy
  hand-authored files, only npc.* ids are treated as build-owned)
- resolve() enforces the schema rule that canon entities must be secrecy 0
- resolve() and ladder_rungs() guard against malformed value TYPES (non-int
  secrecy, non-list related/rungs) raising BuildError instead of crashing

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HuHRPE7VfppUJEaoGBEUqZ

tools/content_build/resolve.py

@@ -24,12 +24,21 @@ def resolve(entries: list[Entry]) -> World:
         by_id[e.id] = e
 
     for e in entries:
+        if isinstance(e.secrecy, bool) or not isinstance(e.secrecy, int):
+            raise BuildError("secrecy must be an integer",
+                             source=e.source, entry_id=e.id)
+        if not isinstance(e.related, list):
+            raise BuildError("related must be a list",
+                             source=e.source, entry_id=e.id)
         if e.status not in STATUSES:
             raise BuildError(f"illegal status '{e.status}'",
                              source=e.source, entry_id=e.id)
         if e.namespace not in LEGAL_NAMESPACES:
             raise BuildError(f"illegal id namespace '{e.namespace}'",
                              source=e.source, entry_id=e.id)
+        if e.is_canon_entity and e.secrecy != 0:
+            raise BuildError("canon entity must have secrecy 0",
+                             source=e.source, entry_id=e.id)
         if e.namespace == "npc":
             if e.type != "person":
                 raise BuildError("npc.* entries must have type 'person'",