COSI: After relaxing metadata parsing, servicing operations should make more of an effort to ensure the COSI file is acceptable

> I see, do we do more strict validation/returning errors once we know whether trident is doing `stream image` or something else?

_Originally posted by @ayaegashi in https://github.com/microsoft/trident/pull/394#discussion_r2636465398_

Start by locating the COSI metadata parsing and servicing-operation paths, then determine how the `stream image` operation is distinguished from other operations. Define the acceptable COSI-file checks for each path and verify that invalid metadata produces the intended result.

Written by the indexing model from the issue text.