P3 hardening batch from the 2026-07 rules-layer review

[StreamDemon]

Verified-real but low-urgency findings from docs/reviews/2026-07-03-rules-layer-review.md (PR #19), batched to keep the tracker tidy:

• Sheet saves omits four transcribed kinds: disease, non-lethal poison, harmful drugs, ritual magic; relatedly, P.E. save prose (p.281) extends to disease/all poisons but content maps only magic + lethal poison.
• Spd derives nothing — book gives movement rates (Spd ×20 yds/min, ×5 per melee round).
• level unbounded above (99 validates and extrapolates past the level-15 tables); rolled values not checked against derivable min/max.
• occSpellStrength takes the first spellStrength bonus (.find) while occSaveBonus sums all matches — order-dependent drops on schema-valid multi-entry content.
• Empty atLevels: [] flips a level-gated bonus into an always-on flat bonus.
• resolveSkill has no 0 floor (negative % representable); overrideValue path drops value2.
• spells.known returns live references into the module-level catalog (mutation hazard — freeze or clone).
• schema/dice.ts missing from src/index.ts exports.
• H2H type index is last-wins on duplicate ids (skills/spells fail fast).
• Schema strictness: category free string vs closed set; occBonusSchema weakly discriminated; spellKnowledge accepts negative/zero picks; package.json lacks types and vp pack dist is orphaned (fine while private).

Each is small; good batch for a cleanup PR or to fold into adjacent feature work.