Add pcall guards to cjson.decode in commit, release, and expire Lua scripts

Malformed scope JSON stored in a reservation hash would crash the Lua
script with an unhandled cjson error. Now all cjson.decode calls across
all Lua scripts are pcall-guarded:

- commit.lua: returns INTERNAL_ERROR on malformed JSON
- release.lua: returns INTERNAL_ERROR on malformed JSON
- expire.lua: silently skips budget adjustment (background sweep must
  not get stuck on corrupted data; reservation still expires)
- extend.lua: already guarded in prior commit

https://claude.ai/code/session_01RyMeX221wTfN1atWi98YK2

Author: claude

cycles-protocol-service/cycles-protocol-service-data/src/main/resources/lua/commit.lua

@@ -87,7 +87,10 @@ end
 if not (budgeted_scopes_json or affected_scopes_json) then
     return cjson.encode({error = "INTERNAL_ERROR", message = "Reservation missing scope data"})
 end
-local affected_scopes = cjson.decode(budgeted_scopes_json or affected_scopes_json)
+local ok, affected_scopes = pcall(cjson.decode, budgeted_scopes_json or affected_scopes_json)
+if not ok then
+    return cjson.encode({error = "INTERNAL_ERROR", message = "Malformed scope JSON in reservation"})
+end
 
 -- Calculate delta (actual - estimate)
 local delta = actual_amount - estimate_amount

cycles-protocol-service/cycles-protocol-service-data/src/main/resources/lua/expire.lua

@@ -40,7 +40,8 @@ local affected_scopes_json = redis.call('HGET', key, 'affected_scopes')
 local budgeted_scopes_json = redis.call('HGET', key, 'budgeted_scopes')
 
 if estimate_amount and estimate_unit and affected_scopes_json then
-    local affected_scopes = cjson.decode(budgeted_scopes_json or affected_scopes_json)
+    local ok, affected_scopes = pcall(cjson.decode, budgeted_scopes_json or affected_scopes_json)
+    if not ok then affected_scopes = {} end
     for _, scope in ipairs(affected_scopes) do
         local budget_key = "budget:" .. scope .. ":" .. estimate_unit
         redis.call('HINCRBY', budget_key, 'reserved',  -estimate_amount)

cycles-protocol-service/cycles-protocol-service-data/src/main/resources/lua/release.lua

@@ -70,7 +70,10 @@ end
 if not (budgeted_scopes_json or affected_scopes_json) then
     return cjson.encode({error = "INTERNAL_ERROR", message = "Reservation missing scope data"})
 end
-local affected_scopes = cjson.decode(budgeted_scopes_json or affected_scopes_json)
+local ok, affected_scopes = pcall(cjson.decode, budgeted_scopes_json or affected_scopes_json)
+if not ok then
+    return cjson.encode({error = "INTERNAL_ERROR", message = "Malformed scope JSON in reservation"})
+end
 
 -- Release from all scopes
 for _, scope in ipairs(affected_scopes) do