feat(managementapi): container virtual upstream association routes part 11/15 (S17 Phase 6 plan: 42/42)

Why

A container virtual repository is creatable, and part 9 refuses deleting its upstreams, but nothing can build its upstream list: docker and oci are the two contract formats with no association routes. This part registers their five routes each over the one container junction store. Deps.ContainerVirtualUpstreams is a VirtualUpstreamStore, so its assignment in wire_management.go is the store's compile-time interface check, the one promised on feat(datastore): the container upstream write e... (!2843 - merged) • Hayley Swimelar • 19.5.

The user docs, the audit-record row, the run recipe, and both association sidecars said docker and oci accept no upstreams, so they move with the routes. The e2e catalog scenarios for these routes, e2e.docker.upstreams.list-verdicts and e2e.oci.upstreams.list-verdicts included, land in part 14, test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5.

Main's 8b15d1dc serves include_permissions on every format's upstream list, so the docker and oci lists answer per-row verdicts from this part on, and this part's tests pin them per segment. Part 12 will drop its test asserting the container lists ignore the parameter, test(managementapi): cover the container upstre... (!2857 - merged) • Hayley Swimelar • 19.5.

Depends on: part 9's delete guard, deployed before this part's associate route serves traffic, feat(datastore): refuse deleting a container vi... (!2854 - merged) • Hayley Swimelar • 19.5.

What

The comment on the datastore test TestContainerVirtualUpstreamStore_Dissociate_ReportsTheVacatedRow moves to the present tense ("Its one caller audits from this value") because this part wires that caller, the dissociate handler.

The rebase resolved the run recipe against main's S30 step 15 and S32 step 14: this part's "All four formats are served" paragraph replaces the S30 "matches no route" one, the smoke record cites the 2026-09-25 run at 80 passed, and the seed-container-virtual intro and driver.sh's seed comment now call the seed a direct SQL insert rather than a call to the association routes.

The stack

Fifteen parts, each stacked on the last, each green on its own, reviewed in this order. Each part stays under 700 changed lines, counted as insertions plus deletions against the part it targets.

Part	MR	What
1	feat(datastore): container virtual upstream sto... (!2778 - merged) • Hayley Swimelar • 19.5	store types and the list read
2	chore(datastore): add the container upstream po... (!2839 - merged) • Hayley Swimelar • 19.5	the position helpers
3	chore(datastore): add the container upstream wr... (!2841 - merged) • Hayley Swimelar • 19.5	the write statements
4	feat(datastore): the container upstream write e... (!2843 - merged) • Hayley Swimelar • 19.5	the write envelope and associate
5	feat(datastore): container upstream reposition ... (!2844 - merged) • Hayley Swimelar • 19.5	reposition and dissociate
6	test(datastore): cover the container upstream a... (!2846 - merged) • Hayley Swimelar • 19.5	associate against Postgres
7	test(datastore): cover the container upstream m... (!2852 - merged) • Hayley Swimelar • 19.5	the mutations against Postgres
8	test(datastore): cover the container upstream l... (!2853 - merged) • Hayley Swimelar • 19.5	the list read and repairs against Postgres
9	feat(datastore): refuse deleting a container vi... (!2854 - merged) • Hayley Swimelar • 19.5	the repository delete guard
10	Draft: chore(managementapi): empty part 10/15, ... (!2855 - closed) • Hayley Swimelar • 19.5	closed unmerged, its core landed with Step 41
11	feat(managementapi): container virtual upstream... (!2856 - merged) • Hayley Swimelar • 19.5	the association routes
12	test(managementapi): cover the container upstre... (!2857 - merged) • Hayley Swimelar • 19.5	handler reads and associate
13	test(managementapi): cover the container upstre... (!2858 - merged) • Hayley Swimelar • 19.5	handler refusals and update
14	test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5	handler dissociate and the catalogs
15	test(managementapi): the container upstream ass... (!2860 - merged) • Hayley Swimelar • 19.5	the integration walk

The delete guard in part 9 must be deployed before part 11's associate route serves traffic. Merge order alone does not close the window: within one rollout, a pod without the guard can answer 202 on destructive=true for an upstream that a new pod has just associated, leaving a tombstone the reaper refuses.

Related to #314 (closed)