Preserve route context during Next item revalidation

[hta218]

Summary

• serialize an optional route-context snapshot for per-item revalidation
• validate and reconstruct same-origin request context before consumer client creation
• preserve pathname, search, i18n, page type, and handle through server and client loader paths
• keep legacy clients and one-argument getClient callbacks compatible

Security

• route context is untrusted routing input, never authorization input
• server-owned project, host, API, env, headers, and cookies cannot be supplied by JSON
• malformed, oversized, unknown-page-type, and unknown/nested i18n values fail closed before client creation
• denied Studio/project controls are stripped and responses remain no-store

Verification

• pnpm --filter @weaverse/next test — 153/153
• pnpm --filter @weaverse/next typecheck
• pnpm --filter @weaverse/next build
• pnpm exec biome check packages/next/src packages/next/__tests__ packages/next/README.md --diagnostic-level=error
• packed the candidate into the real Next/Hydrogen POC; POC tests, typecheck, lint, build, and actual API-route probe passed
• independent source-aware review blockers were resolved and re-reviewed before publication

Manual follow-up

The final authenticated Studio iframe smoke remains pending until the POC consumes the published prerelease. No no-remount/scroll-continuity claim is made yet.

Refs Weaverse/builder#2737