13 of 21 ops-API arms return 500 where 400 is correct (messages already correct — only the status code and wrapp

From dispatch finding (task `qa-wave-2026072818`):

13 of 21 ops-API arms return 500 where 400 is correct (messages already correct — only the status code and wrapper are wrong), plus two confirmed null-receiver crashes of the `X.y?.(` shape that *looks* defensive but isn't. A verified patch now exists: 2 files, 4 substantive lines, manager cold-rerun **3/8 unpatched main → 8/8 patched**, sitting uncommitted in worktree `kris/qa844-errcodes` because product code stays suggest-and-confirm. It wraps `ResourceBridge.ts:374/:403` the way `:78` in the same file already does, guards `:411` with `typeof value === 'string'` (strictly better than `value?.includes?.()` — an *array* value containing `'*'` used to enter the wildcard branch and then throw on `.startsWith`), and short-circuits `searchValidator.ts:141`.

Read ResourceBridge.ts at lines 374, 403, and 411, comparing the existing handling at line 78, then inspect searchValidator.ts:141. Re-run the manager cold-rerun from qa-wave-2026072818; done means all 8 of 8 cases pass, the affected arms return 400, and the null-receiver crashes no longer occur.

Written by the indexing model from the issue text.