fix(build): reject URL-normalized CDN warm paths

[james-elicx]

Summary

• reject raw backslashes and control characters in string getStaticPaths entries
• reject decoded or generated dot path segments before manifest emission
• prevent WHATWG URL normalization from warming a different App, Pages, or API cache key than discovery selected

Tests

• vp test run tests/prerender-paths.test.ts tests/cloudflare-cdn-warm.test.ts
• vp check packages/vinext/src/build/prerender-paths.ts tests/prerender-paths.test.ts

Stacked on #3054.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@3055

npm i https://pkg.pr.new/create-vinext-app@3055

npm i https://pkg.pr.new/@vinext/types@3055

npm i https://pkg.pr.new/vinext@3055

commit: 30569e5

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original
workers-cache	preview	production
web	preview	production

[github-actions]

Performance benchmarks

Compared 30569e5 against base 26b3b5e using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	142.2 KB	142.2 KB	⚫ -0.0%
Client entry size (gzip)	vinext	129.5 KB	129.5 KB	⚫ -0.0%
Dev server cold start	vinext	2.99 s	3.02 s	⚫ +1.1%
Production build time	vinext	3.26 s	3.27 s	⚫ +0.5%
RSC entry closure size (gzip)	vinext	116.2 KB	116.1 KB	⚫ -0.0%
Server bundle size (gzip)	vinext	197.7 KB	197.6 KB	⚫ -0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[james-elicx]

Superseded by consolidated PR #3057. No commits were dropped or rewritten: #3057 now contains this exact linear commit as part of #3047–#3057. Closing only the redundant draft PR.