`registry__patch_container`

Update a container by handle with merge semantics.

Inputs: required container and id, plus fields allowed by that arm. Workspaces can change display_name, description, or parent_id; projects can also change workspace_id and knowledge_urls; repos can change project_id.
Returns: the updated container.
Effect: writes state. The machine name is immutable.

Moving a workspace or project checks permissions on both the current and new location. A move that would create an invalid hierarchy is rejected.