A jinja or gzipped cloud_init is refused at the seed build, not as a 400 at the API

open   by a73x

Labels: backlog

[claude 2026-09-02] Since the seed composes user-data as a MIME archive with eitri's cloud-config as the last part (fix for 6b070494), a tenant cloud_init that is a jinja template (## template: jinja) or gzip cannot carry eitri's part and the seed build refuses it. That refusal lands in the agent, so it surfaces as a failed create rather than a clean 400. The control plane already rejects those payloads, but only on the path that classifies the document — when an SSH key is supplied alongside. Make the API classify and refuse them on every create, with the same wording the seed uses, so the tenant sees a 400 that says why.