fix(ec2): close the gaps in the IPAM internet-registry operations

[vieiralucas]

A review of the 15 IPAM internet-registry / routing-policy-registration operations that shipped in #2511 found them accepting requests they then failed to honour. Each defect is fixed here with the test that proves it.

Wire correctness

• Child request XML escaped: a ServiceUri containing &, or a handle containing ", produced a document the RIR cannot parse (200 to the caller, breakage discovered later).
• Batch ASNs written as JSON numbers were dropped, registering a CIDR that authorizes nobody and self-reports unknown/permissive.

Requests accepted but not honoured

• A batch entry that could not be applied was skipped after the document was recorded as published; the document is now validated first and a bad entry fails the request.
• Batch entries bypassed single-op validation, storing and emitting maxLength=200 for a member the model bounds to 0..48. One shared validation; a batch add on an existing CIDR is an upsert per the op's docs.
• Modify rebuilt the record, silently clearing MaxLength / Description / PermitMoreSpecificAnnouncements when omitted. Now a partial update.
• ClientToken was modeled on all five mutating ops and ignored: a retried timed-out create got a conflict instead of a replay.
• The eight paginated reads validated MaxResults then returned everything with no nextToken, and discarded modeled Filters.

Preconditions

• DryRun returned success before the checks it exists to surface (existing CIDR, nonexistent IPAM, unregistered CIDR). Dry runs now reach the same verdict as the real call.
• pending-enable was documented but unenforced, leaving EnableIpamInternetRegistryAssociation decorative.
• DeleteIpamInternetRegistryAssociation deleted an association out from under its registrations; now DependencyViolation until they are gone.

Adjacent, same class

• A conformance ordering assertion compared Option<usize>, so a dropped delta passed vacuously (None < Some).
• The bounded container-CLI helper left its reader thread blocked on a pipe a wrapper script's grandchild still held -- a leaked thread per timed-out call on the wedged-daemon path the bound exists for. Now runs the CLI in its own process group and kills the group; collection bounded by a drain grace. fakecloud-testkit carried a second leaky copy and now shares core's, and detect_bridge_gateway (still unbounded) goes through them.

Local gate: workspace build + clippy -D warnings clean, fmt clean, 22 IPAM unit tests, 9 bounded-CLI tests, 9 testkit tests, 69 EC2 IPAM conformance tests green.

---

Summary by cubic

Fixes the 15 IPAM internet-registry operations that accepted requests they didn’t honor. All operations now follow their modeled contracts: wire documents are valid, batch and single-operation behavior match, mutating operations are idempotent and respect preconditions, and reads paginate and filter.

Bug Fixes

• Escapes ServiceUri, handles, RPKI version, and parent BPKI TA in child request XML; & and quotes no longer produce a document the RIR can’t parse.
• Accepts batch ASNs written as JSON numbers; previously they were dropped, registering a CIDR that authorized no one.
• Validates a batch document against the state it produces before recording any of it; an invalid entry fails the request instead of being skipped after success.
• Applies one shared validation to batch and single-operation registrations; batch add on an existing CIDR acts as an upsert.
• Runs Modify as a partial update, preserving omitted members.
• Clears MaxLength, Description, and PermitMoreSpecificAnnouncements when sent as an empty value or JSON null, while omitted still means unchanged.
• Records ClientToken with a fingerprint of the request parameters, so retries replay the original result; reuse with different parameters returns IdempotentParameterMismatch.
• Ages token records out after 24 hours and caps them oldest-first, so create/delete loops no longer grow state forever.
• Enforces pending-enable for registration writes; removal is not gated, so an association restored from an older snapshot can still be emptied and deleted.
• Returns DependencyViolation when deleting an association that still has registrations.
• Pages the eight read operations honoring MaxResults, Filters, and nextToken; reverse paging uses delta ids so new deltas between pages aren’t repeated, and non-numeric MaxResults is rejected instead of returning everything.
• Makes dry runs reach the same verdict as real calls.
• Fixes a conformance ordering assertion that compared Option<usize> and passed vacuously when a delta was dropped.
• Runs the bounded container-CLI helper in its own process group with /dev/null stdin, so a wedged daemon no longer leaks a reader thread; fakecloud-testkit shares core’s helpers and detect_bridge_gateway goes through them too.

^{Written for commit 96e7bb6. Summary will update on new commits.}