fix(batch): byte-safe percent-decode + bound array job size

[vieiralucas]

Two request-path input-safety bugs in the new AWS Batch service, found by the 2026-06-27 bug-hunt (Tier 2 + Tier 3).

1. CRITICAL — percent_decode panic drops the connection

percent_decode (crates/fakecloud-batch/src/service.rs) sliced the &str at byte offsets (&s[i+1..i+3]). A % adjacent to a multi-byte UTF-8 char — e.g. a tag request GET /v1/tags/%€ — lands i+3 inside the char, panicking with "byte index is not a char boundary". There is no catch_unwind in core/server, so the request task dies and the client sees a dropped connection (the #1539 Bug-2 failure mode), not a clean response. It was also latin-1-corrupting legitimately decoded multi-byte sequences (b as char).

Fix: decode %XX on the raw bytes (always char-safe) and reassemble via from_utf8_lossy. caf%C3%A9 -> café now round-trips.

2. MEDIUM — unbounded array job size

SubmitJob accepted any arrayProperties.size > 1 and synchronously looped that many container launches (each taking the state write lock + a real ECS RunTask) — a single-request resource-exhaustion vector. Validate 2..=10000 (the AWS range) and return ClientException otherwise.

Tests

3 new unit tests: multi-byte percent-decode doesn't panic + round-trips; ListTagsForResource with a raw multi-byte ARN returns normally; SubmitJob rejects out-of-range array sizes (0/1/-3/10001/2e9). cargo test -p fakecloud-batch 17 pass.

---

Summary by cubic

Make request parsing in fakecloud-batch safe by decoding percent-escapes on bytes and enforcing array job size limits. Prevents dropped connections and single-request resource exhaustion.

• Bug Fixes
  • percent_decode now decodes %XX on raw bytes and rebuilds with from_utf8_lossy, handling multi-byte UTF-8 safely (e.g., caf%C3%A9 -> café) and avoiding panics when % is next to a multi-byte char.
  • SubmitJob validates arrayProperties.size in 2..=10000 (AWS range). Out-of-range returns ClientException instead of launching unbounded containers.
  • Tests added for multi-byte decoding, tag listing with a multi-byte ARN, and array size validation.

^{Written for commit 75999c8. Summary will update on new commits.}