fix(ppr): consumption-lane rule — handler ctx.use(loader) bakes during shell capture - #674

…ites (closes #725 gap)

The cached-scope header guard (#725) exempted every loader body under a
cache() boundary via isInsideAnyLoaderScope(). That let a handler-invoked
loader — await ctx.use(Loader) from a handler, never registered with
loader() — write a cookie/header on the MISS. On a HIT the handler is
skipped and only DSL-registered loaders re-run, so that loader never
executes and its write silently vanishes — the exact MISS/HIT divergence
#725 was built to eliminate.

Narrow the exemption to isInsideLoaderScope() (DSL scope only): registered
loaders re-run on every HIT and merge into every response, so their writes
stay allowed; a handler-invoked loader now throws deterministically like a
handler write. The DSL scope ALS survives nested ctx.use bodies, so a
handler-invoked loader nested under a DSL loader stays exempt (its parent
re-runs it every HIT). The broad predicate is deferred to the throw path for
the error label so the PPR handler-invoked-loader message stays "loader",
and the throw reason keys on scope.kind so the cache() case explains the
handler-skip cause. Re-ground the neighbouring read-purity guard comment,
which this change makes contradictory: reads stay on the broad predicate
under the consumption-lane baked-copy tradeoff (#672/#674), only writes
narrow to DSL scope.

Unit (cached-header-guard.test.ts): DSL-allowed pin, handler-invoked-throws
pin (red before this change, green after), nested-under-DSL-allowed pin.
E2e (cache-scope-guard, dev + production): /handler-loader-cookie-blocked
asserts the error boundary renders and the cookie never reaches the wire;
the DSL /loader-cookie-allowed control stays green in both modes.

…ites (#725 gap) + drop removed __debug_manifest docs (#730)

* fix(router): handler-invoked loaders under cache() throw on header writes (closes #725 gap)

The cached-scope header guard (#725) exempted every loader body under a
cache() boundary via isInsideAnyLoaderScope(). That let a handler-invoked
loader — await ctx.use(Loader) from a handler, never registered with
loader() — write a cookie/header on the MISS. On a HIT the handler is
skipped and only DSL-registered loaders re-run, so that loader never
executes and its write silently vanishes — the exact MISS/HIT divergence
#725 was built to eliminate.

Narrow the exemption to isInsideLoaderScope() (DSL scope only): registered
loaders re-run on every HIT and merge into every response, so their writes
stay allowed; a handler-invoked loader now throws deterministically like a
handler write. The DSL scope ALS survives nested ctx.use bodies, so a
handler-invoked loader nested under a DSL loader stays exempt (its parent
re-runs it every HIT). The broad predicate is deferred to the throw path for
the error label so the PPR handler-invoked-loader message stays "loader",
and the throw reason keys on scope.kind so the cache() case explains the
handler-skip cause. Re-ground the neighbouring read-purity guard comment,
which this change makes contradictory: reads stay on the broad predicate
under the consumption-lane baked-copy tradeoff (#672/#674), only writes
narrow to DSL scope.

Unit (cached-header-guard.test.ts): DSL-allowed pin, handler-invoked-throws
pin (red before this change, green after), nested-under-DSL-allowed pin.
E2e (cache-scope-guard, dev + production): /handler-loader-cookie-blocked
asserts the error boundary renders and the cookie never reaches the wire;
the DSL /loader-cookie-allowed control stays green in both modes.

* docs: drop the removed __debug_manifest browser endpoint from the skill and guide

#728 deleted the ?__debug_manifest HTTP endpoint and its routeAncestry
data, but the debug-manifest skill and docs guide still told users to open
http://localhost:PORT/?__debug_manifest and documented the deleted
{ routerId, routeManifest, routeAncestry, routeTrie, precomputedEntries }
shape. Remove both browser-endpoint sections; both files already carry the
correct router.debugManifest() programmatic path ({ routes, layouts,
totalRoutes, totalLayouts }), now the primary documented route.