fix(prompt_gateway): return 400 for malformed arch state

[SomSamantray]

Malformed x-arch-state metadata on /v1/chat/completions now returns a controlled 400 Bad Request response instead of panicking the prompt gateway. Valid state metadata continues to parse normally.

Fixes #1030.

Validation: all five prompt gateway tests, the WASM release build, locked clippy, formatting, and repository pre-commit hooks passed.

AI disclosure: OpenAI Codex assisted with the diagnosis and patch; the final code and test results were reviewed.

[SomSamantray]

CI and review have settled on head eb6fc45c9a0173d3630b76e43e5f1bd0ba991cc4. There are no review comments or submitted reviews. The PR is still blocked by required review and the failing checks below. No code-specific failure was found, and no further files or commits were added.

Successful checks: Docker build, native smoke test, plano tools tests, config validation, security scan, and Trivy. The prompt-gateway unit tests, WASM release build, locked clippy, formatting, and repository pre-commit hooks passed locally.

Needs your decision

decision:ddba0ee19de38e8810bd04bdc1f168b8e6e10533b170e27b0f910c6f758c9d24 — provider-backed integration checks

• Checks: e2e-demo-currency, e2e-demo-preference, e2e-plano-tests for Python 3.10–3.14, test-model-alias-routing, test-prompt-gateway, and test-responses-api-with-state (run).
• CI output: “No access key configured for selected LLM Provider”; demo provider key variables are empty.
• Investigation: The failed model and E2E jobs reach provider calls without credentials. The prompt-gateway requests returning 400 omit metadata, so the changed x-arch-state parser is not exercised.
• Decision reason: These checks require repository or workflow credentials unavailable to this run. Adding secrets or changing tests to bypass provider calls is outside the issue fix.
• Options: Have maintainers provide the provider credentials and rerun the checks, which validates integration behavior but requires repository-owned secrets; or treat the checks as blocked for this fork PR, which leaves provider-backed integration coverage unverified.
• Recommendation: Treat these as repository configuration blockers; no source change is warranted.

decision:f5fddfb9641b8b08b4080b9acb1bce4359aa71a3587c22692bc42fdc8db1ce95 — pre-commit clippy

• Check: pre-commit (run).
• CI output: clippy::double_must_use errors in crates/brightstaff/src/session_cache/mod.rs and crates/brightstaff/src/state/mod.rs under Rust/Clippy 1.99.0.
• Investigation: Those files are unchanged; this PR modifies only crates/prompt_gateway/src/http_context.rs. Workspace clippy passed locally using the repository’s documented Rust 1.93 toolchain.
• Decision reason: Changing unrelated code would not be a fix for this PR.
• Options: Fix the Rust 1.99 lint errors in a separate maintenance change, restoring CI compatibility but broadening this PR; or pin CI to the documented toolchain, avoiding the new diagnostics but delaying newer stable compiler checks.
• Recommendation: Keep this PR scoped and have maintainers handle the baseline lint/toolchain mismatch separately.