It depends. And a LOT depends on state law.
First, it depends on the nature of the online conduct itself. It may be that there are state laws that generally protect employees from employer regulation of certain conduct. There are certainly federal laws that do in some limited instances (e.g., the National Labor Relations Act protects employees engaged in "concerted activity" which is where more than one employee talks about working conditions and such. That's been extended to social media activity by the National Labor Relations Board in the past, but usually when you're complaining about things like "They don't pay us enough for this s***" or whathaveyou. It's really fact-dependent, though.
State laws may go beyond that.
Then there's the question of, ok, you've got a law on the books that says an employer can't prohibit an employee from doing X, but can an employee willingly contract that away? That's a question that's usually resolved by state caselaw where past court cases interpret the meaning of statutory/regulatory language and apply it to specific fact patterns. Most of the time when a law says "employers can't do X," there's a public policy basis for courts to say "They passed this law for XYZ reason, so you can't just allow employees to contract that away," but that's not always the case.
And separate from all of that, of course, is the Federal Arbitration Act which will kick a lot of stuff to arbitration (and out of the public eye) if you signed an arbitration clause, except in very limited circumstances (I think only when the conduct in question falls outside of the scope of the contract itself). As has been mentioned, Disney almost certainly had a conduct clause (regardless of whether it's enforceable), which would mean this probably falls under the scope of the contract and therefore gets roped into arbitration.
That'd be....surprising.
There's a concept in the law called the "statute of frauds" which generally means that most verbal agreements are nonbinding. Typically stuff dealing with real estate or anything else worth more than, like, $500 falls into that. Of course, that all depends on state law application of general contract law concepts, but by and large, that's what you learn in 1st year of law school: verbal contracts ain't worth the paper they're printed on.
Especially for something like this, if they told Carano "Yeah, yeah, we'll give you a show later," it's unlikely that that'd count as a verbal contract that's enforceable. I mean, I had a law school professor who called California "Crazyland" for their various state laws, but I'd be very surprised to learn that, in the home of the entertainment industry, mere verbal statements of "We'll do a movie together" could somehow be legally binding.
This last part here is the meat of the case, yeah, but just looking at the statutes on their face doesn't really tell you a ton without knowing how California courts actually interpret and apply those concepts.
So, for example, the portion about "participating in politics." What actually counts? Presumably it'd be a slam-dunk if Carano was fired for, for example, supporting XYZ candidate's campaign by contributing money and/or volunteering to knock doors for them. But does that extend to just BSing online? I don't know. You'd figure there'd be caselaw on this, but maybe not.
Second, what does "adopting a course or line of political action" actually mean as interpreted by courts? Does that include general social media activity? Would it include, say, poking fun at XYZ group? Like, if Carano had said something overtly, unquestionably racist, is that "political action"? Again, I dunno, and it depends on existing caselaw.
My point in all of this is that while it might seem obvious that she can say what she wants on her own time....that's not necessarily the case (A) if there's a conduct clause in her contract, and (B) the conduct in question doesn't otherwise fall within the scope of those statutory protections. And I wouldn't bet that it does, depending on which posts we're talking about.
Separate from that, I don't know how CA law interprets this stuff when you aren't talking about salaried work, but rather are talking about "gig" work (so to speak). Like, they hired her to do a discrete job. She did that. They'd talked about doing something else, then said "Nah, we don't like how you comport yourself online. We're done."
Does that entitle her to relief? That's a much more thorny question than an employee who, say, works for Hobby Lobby as a full-time employee, volunteers for a trans political candidate, and is fired because of it.
I am not in any position to tell if this is a slam-dunk or not. I was mainly responding to your initial assessment that the case for Carano was specious at best.
Correct me if I am wrong, but it seems to me that, while no company is obliged to continue business with anybody, Disney, in their public statement about Carano acted as the engine for this lawsuit. Implicit in that statement is their prior intent to have kept Carano for future projects as well as their reason for change being retaliatory in nature.