test(program-d): update C# create-handler source assertion for the try/catch

The Program-D malformed-body fix wrapped the create-handler DTO deserialize in a
try/catch (JsonException -> 400). Update EntityGeneratorTests to assert the new
form. C# Codegen.Tests 278/0; api-contract lanes 75/75 — no runtime regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGQ7oSuNcjhsMHWwZzhBwr

Author: dmealing

server/csharp/MetaObjects.Codegen.Tests/EntityGeneratorTests.cs

@@ -108,11 +108,14 @@ public void Routes_generator_emits_crud_endpoints()
         // presence-checking create handler: it reads the raw JSON body (HttpContext),
         // rejects a body missing/null-ing any @required key with 400 {error:"validation"}
         // BEFORE binding (a value-type default can't be seen as "missing" by [Required]),
-        // then deserializes + DataAnnotations-validates.
+        // then deserializes (Program D: inside a try/catch so a malformed body is a 400,
+        // not an unhandled 500) + DataAnnotations-validates.
         Assert.Contains("app.MapPost(prefix + \"/subscribers\", async (HttpContext http, AppDbContext db) =>", src);
         Assert.Contains("foreach (var __req in new[] { \"email\" })", src);
         Assert.Contains("if (!__present.Contains(__req)) return Results.BadRequest(new { error = \"validation\" });", src);
-        Assert.Contains("var input = System.Text.Json.JsonSerializer.Deserialize<Subscriber>(__body.RootElement.GetRawText(), jsonOpts);", src);
+        Assert.Contains("Subscriber input;", src);
+        Assert.Contains("try { input = System.Text.Json.JsonSerializer.Deserialize<Subscriber>(__body.RootElement.GetRawText(), jsonOpts); }", src);
+        Assert.Contains("catch (System.Text.Json.JsonException) { return Results.BadRequest(new { error = \"validation\" }); }", src);
         // PATCH + PUT share the same update handler (matches TS reference). It takes the raw
         // HttpContext (not a bound DTO) and PARTIAL-merges only the properties present in the
         // JSON body — a bound DTO would fill omitted fields with CLR defaults and clobber them.