A list route given a cursor or state it cannot read answers 422, never page one again #8504

Intent: an agent paging with a mangled cursor is stopped and told so. Today it is handed page one again and can loop forever.

Today: in src/http/api.ts, listQuery (~822) drops a cursor that is not a positive integer and starts again from the first page. It also reads any state other than closed or all as open, so state=bogus and state=Closed both silently list open issues. repoQuery (~921) passes any cursor string through: /api/v1/repos?cursor=%25%25 answers 200 with an empty page.

Done looks like:

• [x] Issue and pull lists answer 422 invalid_cursor ("cursor is the next_cursor of a previous page") for a cursor that is not a positive integer, and 422 invalid_state ("state is open, closed or all") for any other state. An absent state still means open.
• [x] Repository lists answer 422 invalid_cursor for a cursor outside the id alphabet pageParams already checks (^[A-Za-z0-9_-]{1,64}$).
• [x] Following each route's next_cursor still walks every page; the tests prove it on a list of three pages.
• [x] Tests for each refusal on /api/v1/repos/:owner/:name/issues, /pulls and /api/v1/repos.

Files: src/http/api.ts (listQuery, repoQuery), the API list tests. Waits for #8490, which changes the same two functions.

Left open after pull #8624 landed: 4 unticked items remain (Issue and pull lists answer 422 invalid_cursor ("cursor is the next_cursor of a previous page") for a cursor that is not a positive integer, and 422 invalid_state ("state is open, closed or all") for any other state. An absent state still means open.; Repository lists answer 422 invalid_cursor for a cursor outside the id alphabet pageParams already checks (^[A-Za-z0-9_-]{1,64}$).; Following each route's next_cursor still walks every page; the tests prove it on a list of three pages.; …). Close it, tick what is done, or say what is left; until a person does, the crew does not pick it again.

Reviewed pull #8624 at its head: ticked Issue and pull lists answer 422 invalid_cursor ("cursor is the next_cursor of a previous page") for a cursor that is not a positive integer, and 422 invalid_state ("state is open, closed or all") for any other state. An absent state still means open.; Repository lists answer 422 invalid_cursor for a cursor outside the id alphabet pageParams already checks (^[A-Za-z0-9_-]{1,64}$).; Following each route's next_cursor still walks every page; the tests prove it on a list of three pages.; Tests for each refusal on /api/v1/repos/:owner/:name/issues, /pulls and /api/v1/repos..

Already done on main in d0e906dd. Covered by test/list-cursor-state.test.ts.