Reject root object names in blob storage

[vigoo]

Summary

• reject root-naming object inputs with permanent InvalidInput errors across blobstore writes, deletes, checks, metadata, copy, and move operations
• preserve the existing get_data(container, root) read behavior while validating both object endpoints and every batch-delete name before mutation
• replace the list_objects path-name unwrap with an error path and cover it through the service
• add service regressions across in-memory, filesystem, and SQLite backends plus a host-level in-memory regression for the container-hiding behavior

Dependency

This PR is stacked on #3947, which provides the backend and root-container contract prerequisites from GOL-622/GOL-627. It should be reviewed and landed after that PR.

Verification

• cargo fmt -p golem-worker-executor -- --check
• cargo clippy -p golem-worker-executor --lib --tests --no-deps -- -D warnings
• cargo test -p golem-worker-executor --lib -- services::blob_store::tests --report-time
• cargo test -p golem-worker-executor --test integration -- blobstore_rejects_root_container_names_without_retrying blobstore_rejects_root_object_names_without_hiding_the_container --report-time

Resolves GOL-635

[netlify]

✅ Deploy Preview for golemcloud ready!

Name	Link
🔨 Latest commit	45142d4
🔍 Latest deploy log	https://app.netlify.com/projects/golemcloud/deploys/6ab502fa136067000884f769
😎 Deploy Preview	https://deploy-preview-3942--golemcloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kmatasfp]

Review of dca0aae. The fix is correct. Two changes before it lands:

1. BlobStoreError::Other is transient in classify_blob_store_error, so a listing path with no name now makes the executor retry an answer that will never change. A permanent kind fits better.
2. The PR closes one of GOL-635's two defects. The object-name half (write_data("c", "") hides the container) is still open, so "Part of GOL-635" is more accurate than "Resolves".

Also:

• The test calls the new object_names helper directly. If list_objects went back to .unwrap(), the test would still pass. A test that drives list_objects over a BlobStorage fake whose list_dir returns an empty path would guard the call site.
• main already has the host-api-tests/Cargo.lock hunk (Support independent secret restrictions for tool middleware #3936), so it can be dropped.
• Landing this before or after Align blob storage backend and root-container contracts #3947 works either way. The only overlap is a one-line text conflict on the same list_objects chain.

cargo test -p golem-worker-executor --lib -- services::blob_store::tests passed locally (9/9).

[kmatasfp]

Review of e32e53a. Thank you, this now covers all of GOL-635. Root object names are rejected with a permanent InvalidInput on every method that takes one, including both ends of copy and move and the whole batch in delete_objects. get_data(c, "") is unchanged, the list_objects unwrap is gone, and the host test runs on the in-memory backend as the issue asked. The services::blob_store lib tests pass locally (16/16), and CI ran both host tests green.

Since this is stacked on #3947, which waits for the filesystem-snapshot blob storage work to land on main, I'll take both PRs over from here once that branch lands. We have the context on how #3947 has to change against the settled contract, and I expect to salvage good parts of both. Nothing more is needed from you on either one.

Two notes I'll carry into the takeover, for the record:

• object_names returns BlobStoreError::Other, which classify_blob_store_error treats as transient, so a backend that returned a nameless path would make the guest retry forever. It should be InvalidInput.
• object_path should also reject a leading /. Today "/abs" fails only because Path::join replaces the container and the backend refuses the absolute path. With the /-join from Fix platform-independent blob storage keys #3943 it becomes c//abs, where the backends disagree.

[vigoo]

@kmatasfp Thanks. One correction for the takeover: the nameless-listing error does not currently retry. list_objects_durable_access embeds the service error string directly in HostResponseBlobStoreListObjects and does not call classify_blob_store_error. I kept Other because this is malformed backend output rather than invalid guest input. If we want a permanent internal-contract error category, that should be a separate typed variant.

I agreed with the absolute-object-name integration safeguard and pushed 36e28d5: object_path now rejects absolute names directly as InvalidInput before joining them with the container, with a focused regression.