test(managementapi): cover the container upstream reads and associate part 12/15 (S17 Phase 6 plan: 42/42)

Why

Part 11 registered the routes with the contract, binding, and wiring tests that prove they are served and bound. Only its list tests exercise a handler's behaviour, so the rest of the dispatch and the rendering is unproven until this suite runs it.

It also mirrors the Maven list-verdict tests that part 11's list tests leave open: the empty list opted in, an unavailable or abandoned evaluator, an unusable verdict batch, and a repeated include_permissions value, which joins part 11's malformed table.

The summary's per-upstream read_repository gate landed first, in feat(managementapi): serve upstream visibility,... (!2959 - merged) • Hayley Swimelar • 19.5, so this part's rig gives its caller read_repository on every upstream. A new case pins the associate's 201 for a caller who reads none of them.

The stack

Fifteen parts, each stacked on the last, each green on its own, reviewed in this order. Each part stays under 700 changed lines, counted as insertions plus deletions against the part it targets.

Part	MR	What
1	feat(datastore): container virtual upstream sto... (!2778 - merged) • Hayley Swimelar • 19.5	store types and the list read
2	chore(datastore): add the container upstream po... (!2839 - merged) • Hayley Swimelar • 19.5	the position helpers
3	chore(datastore): add the container upstream wr... (!2841 - merged) • Hayley Swimelar • 19.5	the write statements
4	feat(datastore): the container upstream write e... (!2843 - merged) • Hayley Swimelar • 19.5	the write envelope and associate
5	feat(datastore): container upstream reposition ... (!2844 - merged) • Hayley Swimelar • 19.5	reposition and dissociate
6	test(datastore): cover the container upstream a... (!2846 - merged) • Hayley Swimelar • 19.5	associate against Postgres
7	test(datastore): cover the container upstream m... (!2852 - merged) • Hayley Swimelar • 19.5	the mutations against Postgres
8	test(datastore): cover the container upstream l... (!2853 - merged) • Hayley Swimelar • 19.5	the list read and repairs against Postgres
9	feat(datastore): refuse deleting a container vi... (!2854 - merged) • Hayley Swimelar • 19.5	the repository delete guard
10	Draft: chore(managementapi): empty part 10/15, ... (!2855 - closed) • Hayley Swimelar • 19.5	closed unmerged, its core landed with Step 41
11	feat(managementapi): container virtual upstream... (!2856 - merged) • Hayley Swimelar • 19.5	the association routes
12	test(managementapi): cover the container upstre... (!2857 - merged) • Hayley Swimelar • 19.5	handler reads and associate
13	test(managementapi): cover the container upstre... (!2858 - merged) • Hayley Swimelar • 19.5	handler refusals and update
14	test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5	handler dissociate and the catalogs
15	test(managementapi): the container upstream ass... (!2860 - merged) • Hayley Swimelar • 19.5	the integration walk

The delete guard in part 9 must be deployed before part 11's associate route serves traffic. Merge order alone does not close the window: within one rollout, a pod without the guard can answer 202 on destructive=true for an upstream that a new pod has just associated, leaving a tombstone the reaper refuses.

698 changed lines against guardrail 18's 500 ceiling: this part is one coherent test group, and splitting it further would separate cases that share a rig and a fixture.

This test-only part adds no e2e scenario (guardrail 12): the docker and oci upstream scenarios, list-verdicts included, land in part 14, test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5. It changes no customer-visible surface, so no docs/user page moves (guardrail 24).

Related to #314 (closed)