test(managementapi): cover the container upstream dissociate and the scenario catalogs part 14/15 (S17 Phase 6 plan: 42/42)

Why

Parts 12 and 13 left the dissociate group and the three 500 paths uncovered, and part 11 said the scenario catalogs land here. Guardrail 12 asks every behaviour-changing MR to update the catalogs or say why none is affected, so this part closes that debt for the whole stack. This part changes no customer-visible surface, so no docs/user/ page moves (guardrail 24).

It also adds the container mirrors of the Maven suite's cross-arm wiring tests, and the delete guard's handler table now covers all four formats whose store raises the sentinel. The sidecar's lock-wait paragraph now names the item that tracks those waits, The virtual-upstream association stores take tw... (#1401) • Unassigned.

This part carries the three changes vespian_gl asked for on part 13, tracked in Follow-up from "test(managementapi): cover the ... (#1496 - closed) • Unassigned:

• The foreign-upstream refusal runs under a check that reads nothing, and it must match the unknown upstream's refusal in every header and body byte. The self-reference table drops a row check no handler could fail.
• The update table's own 400 rows assert that no move reached the store, in place of a position check no row could fail.
• The mixed-format list test is gone. The position-ordered list test sends the same request over the same rows and checks each row's format.

The stack

Fifteen parts, each stacked on the last, each green on its own, reviewed in this order. Each part stays under 700 changed lines, counted as insertions plus deletions against the part it targets, except part 13 at 891, which carries part 12's review-driven dedup.

Part	MR	What
1	feat(datastore): container virtual upstream sto... (!2778 - merged) • Hayley Swimelar • 19.5	store types and the list read
2	chore(datastore): add the container upstream po... (!2839 - merged) • Hayley Swimelar • 19.5	the position helpers
3	chore(datastore): add the container upstream wr... (!2841 - merged) • Hayley Swimelar • 19.5	the write statements
4	feat(datastore): the container upstream write e... (!2843 - merged) • Hayley Swimelar • 19.5	the write envelope and associate
5	feat(datastore): container upstream reposition ... (!2844 - merged) • Hayley Swimelar • 19.5	reposition and dissociate
6	test(datastore): cover the container upstream a... (!2846 - merged) • Hayley Swimelar • 19.5	associate against Postgres
7	test(datastore): cover the container upstream m... (!2852 - merged) • Hayley Swimelar • 19.5	the mutations against Postgres
8	test(datastore): cover the container upstream l... (!2853 - merged) • Hayley Swimelar • 19.5	the list read and repairs against Postgres
9	feat(datastore): refuse deleting a container vi... (!2854 - merged) • Hayley Swimelar • 19.5	the repository delete guard
10	Draft: chore(managementapi): empty part 10/15, ... (!2855 - closed) • Hayley Swimelar • 19.5	closed unmerged, its core landed with Step 41
11	feat(managementapi): container virtual upstream... (!2856 - merged) • Hayley Swimelar • 19.5	the association routes
12	test(managementapi): cover the container upstre... (!2857 - merged) • Hayley Swimelar • 19.5	handler reads and associate
13	test(managementapi): cover the container upstre... (!2858 - merged) • Hayley Swimelar • 19.5	handler refusals and update
14	test(managementapi): cover the container upstre... (!2859 - merged) • Hayley Swimelar • 19.5	handler dissociate and the catalogs
15	test(managementapi): the container upstream ass... (!2860 - merged) • Hayley Swimelar • 19.5	the integration walk

The delete guard in part 9 must be deployed before part 11's associate route serves traffic. Merge order alone does not close the window: within one rollout, a pod without the guard can answer 202 on destructive=true for an upstream that a new pod has just associated, leaving a tombstone the reaper refuses.

558 changed lines against guardrail 18's 500 ceiling. This part's own lines are 491 (container_virtual_upstreams_test.go 371, delete_upstream_guard_test.go 54, the docker and oci catalogs 40, upstream_repositories.md 24, observability.md 2). The carried fix is 67, all in container_virtual_upstreams_test.go. It stays here rather than in its own MR because it edits the tests this part's own tests sit beside, in the same file and over the same rig.

Closes #1496 (closed) Related to #314 (closed)