POST /api/goals accepts an unknown verifier; smoke minors (gateway 500, workflow reply prefix, config_section warning, parked card spinner)

[mabry1985]

Found by a live re-smoke of the dev instance:

1. POST /api/goals accepts an unknown verifier and starts a goal turn. {"session_id":"…","condition":"x","verifier":{"type":"plugin","check":"nope:nope"}} → ok, kicked:true, leaving a goal that can never pass. The agent's set_goal tool validates the verifier name (tools/goal_tools.py ~52-55) but set_goal_safe (graph/goals/controller.py ~232-275) doesn't — validate there so every entry point is covered, and return 400 from the route.
2. Minors: an unreachable gateway returns HTTP 500 from /v1 instead of 502; workflow replies start with a raw "[researcher completed: workflow …]" line; the workflows plugin logs "config_section 'workflows' collides with a built-in" on every reload; in a fresh browser a parked turn's ask_human card keeps its spinner/timer and a placeholder message shows as streaming (cosmetic).