Malformed request URL returns 500 instead of 400

_Found running the official Next.js e2e test suite against vinext (vinext 1.0.0-beta.8, Next.js 16.2). Error line is from the suite's own output._

**Fixture:** `test/e2e/middleware-trailing-slash`

**Symptom:** `GET /%2/` (malformed percent-encoding) returns **500**; Next.js returns **400**.

**Repro:** request a malformed-encoding path; expect a 400, not an unhandled 500.

Start with the `test/e2e/middleware-trailing-slash` fixture and run the official Next.js e2e case that requests `GET /%2/`. Trace vinext’s malformed URL handling from that request, then verify that the response is a handled 400 rather than an unhandled 500 and matches Next.js behavior.

Written by the indexing model from the issue text.