refactor(runtime): wrap malformed list_jobs cursors in a stable error

Integer.parseInt on a valid-Base64 but non-numeric cursor threw a raw
NumberFormatException whose parser message was echoed to the client in
INVALID_REQUEST. Both decode failures now surface as a uniform
"invalid cursor" IllegalArgumentException. Addresses the code-quality
review finding on decodeCursor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nficano

arcp-runtime/src/main/java/dev/arcp/runtime/session/JobListing.java

@@ -65,9 +65,14 @@ private static int decodeCursor(@Nullable String cursor) {
     if (cursor == null || cursor.isBlank()) {
       return 0;
     }
-    byte[] decoded = Base64.getUrlDecoder().decode(cursor);
-    int startIndex = Integer.parseInt(new String(decoded, StandardCharsets.UTF_8));
-    return Math.max(0, startIndex);
+    try {
+      byte[] decoded = Base64.getUrlDecoder().decode(cursor);
+      return Math.max(0, Integer.parseInt(new String(decoded, StandardCharsets.UTF_8)));
+    } catch (IllegalArgumentException e) {
+      // Covers malformed Base64 and non-numeric content (NumberFormatException): surface a stable
+      // message instead of the parser's, since the caller echoes it in INVALID_REQUEST.
+      throw new IllegalArgumentException("invalid cursor", e);
+    }
   }
 
   private static String encodeCursor(int index) {