[AZ-1074] [AZ-1075] gRPC tile stream tests and shared proto

Extract tile_provision.proto into GrpcContracts, add integration
tests and validation hardening for DeliverRouteTiles streaming.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/03_implementation/batch_01_cycle9_report.md

@@ -0,0 +1,31 @@
+# Batch Report
+
+**Batch**: 1
+**Tasks**: AZ-1074, AZ-1075
+**Date**: 2026-06-25
+**Cycle**: 9
+
+## Task Results
+
+| Task | Status | Files Modified | Tests | AC Coverage | Issues |
+|------|--------|---------------|-------|-------------|--------|
+| AZ-1074 gRPC TileStream Service | Done | Service existed (275ee1b); added InvalidArgument RpcException + lat/lon validation | 12 unit + smoke integration pass | 4/4 | None |
+| AZ-1075 gRPC Integration Tests | Done | GrpcTestHelpers + RouteTileDeliveryGrpcTests + GrpcContracts project | smoke integration pass | 3/3 | None |
+
+## Notes
+
+- Core gRPC delivery (`DeliverRouteTiles`, orchestrator, proto) landed in commit `275ee1b` before cycle 9 Step 10; this batch adds validation hardening, shared `SatelliteProvider.GrpcContracts`, and blackbox integration coverage.
+- `SatelliteProvider.GrpcContracts` holds `tile_provision.proto` (GrpcServices=Both); Api + IntegrationTests reference it.
+- Integration-tests Dockerfile uses `linux/amd64` to avoid protoc segfault on arm64 Docker.
+- Integration-tests Dockerfile uses `linux/amd64` build + `aspnet:10.0` runtime (Grpc.AspNetCore dependency).
+- Smoke integration run passed (448 unit + full smoke subset including gRPC tests). Local port 5433 conflict avoided via compose override unpublishing host ports; dev TLS cert must include SAN `DNS:api` (regenerate via `scripts/run-tests.sh` if stale).
+
+## AC Test Coverage: All covered
+
+## Code Review Verdict: PASS_WITH_WARNINGS (see reviews/batch_01_cycle9_review.md)
+
+## Auto-Fix Attempts: 0
+
+## Stuck Agents: None
+
+## Next Batch: All tasks complete

_docs/03_implementation/implementation_report_tile_provision_grpc_cycle9.md

@@ -0,0 +1,30 @@
+# Implementation Report — Cycle 9
+
+**Cycle**: 9  
+**Date**: 2026-06-25  
+**Tasks shipped**: AZ-1074, AZ-1075 (batch 1)  
+**Verdict**: PASS  
+**Code Review Verdict**: PASS_WITH_WARNINGS
+
+## Summary
+
+Cycle 9 adds shared gRPC contracts, validation hardening for `DeliverRouteTiles`, and blackbox integration coverage for route tile streaming. Core delivery logic landed in commit `275ee1b`; this batch completes tests, proto project extraction, and InvalidArgument mapping.
+
+## Batch
+
+| Batch | Tasks | Verdict | Report | Review |
+|-------|-------|---------|--------|--------|
+| 01 | AZ-1074, AZ-1075 | PASS | `batch_01_cycle9_report.md` | `reviews/batch_01_cycle9_review.md` |
+
+## Tests
+
+- Unit: 448 passed (Docker SDK run via `scripts/run-tests.sh --smoke --skip-format`)
+- Integration smoke: passed including `RouteTileDeliveryGrpcTests` (manifest, invalid args, backpressure/SHA256, REST overlap)
+
+## Key changes
+
+- `SatelliteProvider.GrpcContracts/` — canonical `tile_provision.proto` (GrpcServices=Both)
+- `RouteTileDeliveryOrchestrator` — lat/lon range validation
+- `RouteTileDeliveryGrpcService` — RpcException InvalidArgument for bad input
+- `RouteTileDeliveryGrpcTests` + `GrpcTestHelpers` — integration coverage
+- Integration-tests Dockerfile — `linux/amd64` build, `aspnet:10.0` runtime

_docs/03_implementation/reviews/batch_01_cycle9_review.md

@@ -0,0 +1,22 @@
+# Code Review — Batch 01 Cycle 9
+
+**Tasks**: AZ-1074, AZ-1075  
+**Verdict**: PASS_WITH_WARNINGS  
+**Date**: 2026-06-25
+
+## Findings
+
+| Severity | Category | Location | Description | Suggestion |
+|----------|----------|----------|-------------|------------|
+| Low | Maintainability | SatelliteProvider.IntegrationTests/Dockerfile | `linux/amd64` platform pin required on arm64 hosts for protoc stability | Document in batch report / README troubleshooting |
+| Low | Style | RouteTileDeliveryOrchestrator.cs | InvalidArgument detail strings include `(Parameter 'job')` suffix from ArgumentException | Optional: strip parameter name for cleaner gRPC detail |
+
+## Spec Compliance
+
+- AZ-1074: DeliverRouteTiles streaming, validation, InvalidArgument mapping — satisfied (unit + integration).
+- AZ-1075: Happy path, invalid requests, backpressure/SHA256, REST vs gRPC overlap — satisfied (smoke integration run passed).
+
+## Security
+
+- No new auth bypass; gRPC inherits JWT from existing API setup.
+- No secrets in source.