chore(datastore): add the container upstream position helpers part 2/15 (S17 Phase 6 plan: 42/42)

Why

The container store settles a list with pure functions over a slice, and their behaviour is reachable by unit test in ways a database is not: the settle has to lift a zero position that check_cvru_position_positive refuses to store.

They land ahead of their callers, which arrive in part 4, because they are separable and worth reading on their own.

The stack

Fifteen parts, each stacked on the last, each green on its own, reviewed in this order. Changed lines counts added plus deleted.

Part	MR	What	Changed lines
1	feat(datastore): container virtual upstream sto... (!2778 - merged) • Hayley Swimelar • 19.5	store types and the list read	380
2	chore(datastore): add the container upstream po... (!2839 - merged) • Hayley Swimelar • 19.5	the position helpers	479
3	chore(datastore): add the container upstream wr... (!2841 - merged) • Hayley Swimelar • 19.5	the write statements	480
4	feat(datastore): the container upstream write e... (!2843 - merged) • Hayley Swimelar • 19.5	the write envelope and associate	466
5	feat(datastore): container upstream reposition ... (!2844 - merged) • Hayley Swimelar • 19.5	reposition and dissociate	344
6	test(datastore): cover the container upstream a... (!2846 - merged) • Hayley Swimelar • 19.5	associate against Postgres	472
7	test(datastore): cover the container upstream m... (!2852 - merged) • Hayley Swimelar • 19.5	the mutations against Postgres	487
8	test(datastore): cover the container upstream l... (!2853 - merged) • Hayley Swimelar • 19.5	the list read and repairs against Postgres	492
9	feat(datastore): refuse deleting a container vi... (!2854 - merged) • Hayley Swimelar • 19.5	the repository delete guard	400
10	Draft: chore(managementapi): empty part 10/15, ... (!2855 - closed) • Hayley Swimelar • 19.5	the format-neutral handler core	417
11	feat(managementapi): container virtual upstream... (!2856 - merged) • Hayley Swimelar • 19.5	the association routes	567
12	test(managementapi): cover the container upstre... (!2857 - merged) • Hayley Swimelar • 19.5	handler reads and associate	598
13	test(managementapi): cover the container upstre... (!2858 - merged) • Hayley Swimelar • 19.5	handler refusals and update	550
14	test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5	handler dissociate and the catalogs	483
15	test(managementapi): the container upstream ass... (!2860 - merged) • Hayley Swimelar • 19.5	the integration walk	527

The delete guard in part 9 lands before the routes in part 11, so no window exists where a container association is writable without the refusal that protects it.

Related to #314 (closed)