fix(build): exclude unsafe Pages CDN warm paths

[james-elicx]

Summary

• exclude concrete Pages-only warm paths when a real Pages API route owns the request
• reject malformed percent-encoding from string getStaticPaths entries during discovery
• prevent deploy warming from invoking API handlers or requesting paths the runtime rejects

Tests

• vp test run tests/prerender-paths.test.ts
• vp check packages/vinext/src/build/prerender-paths.ts tests/prerender-paths.test.ts

Stacked on #3051.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@3052

npm i https://pkg.pr.new/create-vinext-app@3052

npm i https://pkg.pr.new/@vinext/types@3052

npm i https://pkg.pr.new/vinext@3052

commit: 7206033

[github-actions]

Performance benchmarks

Compared 7206033 against base adcabc9 using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	142.2 KB	142.2 KB	⚫ +0.0%
Client entry size (gzip)	vinext	129.5 KB	129.5 KB	⚫ +0.0%
Dev server cold start	vinext	3.14 s	3.11 s	⚫ -0.9%
Production build time	vinext	3.48 s	3.48 s	⚫ -0.0%
RSC entry closure size (gzip)	vinext	116.1 KB	116.2 KB	⚫ +0.0%
Server bundle size (gzip)	vinext	197.7 KB	197.7 KB	⚫ +0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original
workers-cache	preview	production
web	preview	production

[james-elicx]

Superseded by consolidated PR #3057. No commits were dropped or rewritten: #3057 now contains this exact linear commit as part of #3047–#3057. Closing only the redundant draft PR.