Reject malformed container list cursors at handler decode

decodeContainerNameCursor rejects only an empty name. The maven and npm cursor decodes also reject an over-long, control-byte, or invalid-UTF-8 key before any store runs (validPackageCursorKey, validVersionFileKeysetText), so the container image and tag list handlers are the one management read surface that passes the rest of a forged boundary to the stores.

Today the reachable gap is narrow: an over-long or control-byte boundary is a valid comparison and serves a valid-shaped page, and only a NUL byte errors (PostgreSQL rejects it with SQLSTATE 22021, rendered as a 500). The shared keyset-text store guard changes that. Once it lands, the stores reject over-long and control-byte boundaries with their invalid-cursor sentinels, and the container endpoints convert those requests from a served page to a 500 while the maven and npm routes render 400 for the same input. See Extract a shared keyset-text cursor guard for s... (#451 - closed) • Hayley Swimelar.

Proposal: mirror the validPackageCursorKey content checks in the container cursor decode so a malformed boundary renders the documented 400. The cheapest landing is inside the still-open container handlers MR, feat(managementapi): serve the container artifa... (!1133 - merged) • Hayley Swimelar • 19.3. Otherwise this is a small follow-up after it merges.