Internal error in bootstrap agent accessing `/components`

Alan and I are dogfooding on Rack 2. We were doing something else, but confused about the endpoints in the bootstrap agent. We tried to hit another endpoint that should exist to verify, and picked /components. We ran:

BRM42220070 # curl http://[fdb0:a840:2504:154::1]:80/components
{
  "request_id": "c1baf3ba-081b-48f9-9d67-8f90dbcf151b",
  "error_code": "Internal",
  "message": "Internal Server Error"
BRM42220070 # 

And see this in the bootstrap agent logs:

{"msg":"request completed","v":0,"name":"SledAgent","level":30,"time":"1986-12-28T01:56:27.134627922Z","hostname":"BRM42220070","pid":682,"uri":"/components","method":"GET","req_id":"c1baf3ba-081b-48f9-9d67-8f90dbcf151b","remote_addr":"[fdb0:a840:2504:154::1]:62763","local_addr":"[fdb0:a840:2504:154::1]:80","component":"dropshot (BootstrapAgent)","error_message_external":"Internal Server Error","error_message_internal":"Error accessing version information: Malformed version in artifact /opt/oxide/crucible_pantry.tar.gz: Missing 'pkg'","response_code":"500"}

I don't know what's supposed to be happening here, but the 500 and the error about a malformed artifact seem unexpected.

Start by reproducing GET /components against the bootstrap agent and trace the error reported for /opt/oxide/crucible_pantry.tar.gz. Determine how the malformed artifact version is handled and what the endpoint is expected to return when the artifact lacks the required 'pkg' field. Done means the unexpected internal error is addressed and the relevant endpoint behavior is verified.