Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bin/cli/src/commands/build-command.test.ts`:
- Line 168: The test is missing awaiting the rejection assertion, which can
cause false positives; update the test that calls callDockerBuild(service,
"/test/project") so the expect(...).rejects.toThrow("Unknown SDK id:
'definitely-not-a-real-sdk'") is prefixed with await (i.e., await
expect(callDockerBuild(...)).rejects.toThrow(...)) to ensure the promise
rejection is actually asserted in the async test.

In `@bin/cli/src/commands/test-command.test.ts`:
- Around line 156-158: The failing test uses .rejects without awaiting and calls
testService twice; change those assertions to await expect(testService(service,
"/test/project")).rejects.toThrow() and await expect(testService(service,
"/test/project")).rejects.toThrow("Tests failed for service 'failing-service'")
(or combine into a single awaited assertion that checks the message) so the
promise is awaited and the duplicate invocation of testService is removed;
update any other occurrences (e.g., the similar assertion near line 168) to use
await expect(...).rejects.toThrow(...) as well.

In `@docs/src/service-examples.md`:
- Around line 89-104: Remove the shell prompt characters from the console code
blocks in docs/src/service-examples.md: replace lines that start with "$ "
inside the three ```console``` blocks (the docker pull, the cd + docker run
build, and the docker run npm test examples) with the same commands but without
the leading "$ " so the blocks contain only the raw commands; ensure each block
remains fenced with ```console``` at start and end and that spacing/newlines are
preserved.

In `@docs/superpowers/plans/2026-04-28-aslan-framework.md`:
- Around line 203-211: The resolveSdkId function uses the `in` operator which
checks the prototype chain and can cause prototype pollution; change its
property checks to use Object.hasOwn to only test own properties on SDK_CONFIGS
and SDK_ALIASES (i.e., replace `id in SDK_CONFIGS` and `id in SDK_ALIASES` with
Object.hasOwn calls) and keep the same return behavior (returning the id cast to
keyof typeof SDK_CONFIGS or resolving via SDK_ALIASES) so callers of
resolveSdkId are unaffected.