fix(ppr): nested-promise shape IS the liveness declaration — mask nested thenables at capture (loaders + handles); stops per-user data baking into the shared shell - #692

…ane, loading() optional when fully baked

The flag's document promise is "this loader's data, handle pushes, and
status are in the HTML before first flush"; under ppr that silently
degraded — the awaitBeforeFlush await was skipped at capture and the
loader masked like any live-lane loader, so its data arrived in the resume
stream, never the prelude. The capture lane decision is now per LOADER:

- stream:"navigation" — the BAKE lane. Executes at capture; the SETTLED
  return is shell material; nested thenables stay masked (shape is the
  liveness declaration — the #692 cross-session scar) and postpone as
  holes; the masked container registers on _shellCaptureLoaderRecords,
  holding the capture gate (bounded by ppr.captureTimeout) and pinning
  into the shell snapshot so HIT tails replay the baked value and
  hydration stays byte-agreed with the frozen prelude. The dormant
  post-#813 bake machinery (gate hold, snapshot drain, seed overlay,
  pin-first) re-engages unchanged; only the trigger moved from
  "entry lacks loading()" to the explicit per-loader flag.
- Every other loader — LIVE unconditionally, exactly as #813 left it:
  masked, postponed at loading() or an inline Suspense, boundary-less
  reads refuse the capture.

loading() is therefore OPTIONAL when every loader is flagged: nothing
masks, the shell captures complete instead of the eternal-MISS refusal.
Groups inherit through the existing awaitedLoaderIndices projection —
no group-specific code.

Red-proven: the flipped await-before-flush unit (flagged loader executes +
registers its record at capture; plain sibling never runs) and both e2e
pins fail without the capture branch (baked value absent from the prelude;
the fully-baked route degrades to eternal MISS). New pins, dev+prod:
"stream:navigation loader bakes into the shell; nested promise and plain
sibling stay live" (frozen-vs-live seqs across HITs), "fully-baked route
needs no loading()", and the group-ppr probe extended with a baked group
loader frozen in the group shell. Sweeps green: shell-cache +
shell-cache-action + prerender-ppr + semantic-matrix, 88 dev / 90 prod.
Docs: loader-container-bake.md addendum (trigger moved), feature-map PPR
rows, client-urls.md, stream option docs both DSL surfaces, fixture
doctrine header.

…ng for group routes (#817)

* feat(client-urls): ppr as a projected group path option — shell caching for group routes

clientUrls() routes can now declare `ppr: true | PartialPrerenderProps`.
The option was an explicit projection rejection with no structural reason
(unlike parallel/boundaries) — the config is pure JSON and the runtime
shell machinery is route-generic, so this lifts the rejection and threads
the option through the one seam that exists: DSL validation
(validateClientPpr, fails in the authoring module), projection
serialization (serializePpr — frozen JSON copy, re-validated
independently), and materializedPathOptions, where the materialized server
path() stamps it on the manifest entry so resolvePprConfig classifies the
group route exactly like a hand-written ppr page.

The interplay that motivated this lands whole: the group's static markup
freezes into the shell INCLUDING its useSearchParams read — search is part
of shell identity (the key embeds the sorted search and the capture render
seeds that same string), so the frozen value matches the URL the shell
serves and HIT hydration is clean. loading() subtrees stay the live holes;
the server-route rules (loader routes need loading() or capture refuses,
actions/PE/nonce take the live axis) apply unchanged.

Red-proven at both levels: the manifest round-trip unit (entry.ppr
undefined without the materialization spread) and the e2e (x-rango-shell
header absent without the projection). New shell-cache probe "clientUrls
group route with ppr" pins MISS -> HIT, frozen group shell with its search
value in the first flushed bytes, per-request loader liveness under the
frozen shell, and zero-hydration-error browser HIT — dev AND production.
Full shell-cache + client-urls sweeps green both modes (64 dev / 65 prod).
Docs: client-urls.md supported surface + rejection list, feature-map,
client-urls skill.

* feat(ppr): stream:"navigation" loaders BAKE at capture — per-loader lane, loading() optional when fully baked

The flag's document promise is "this loader's data, handle pushes, and
status are in the HTML before first flush"; under ppr that silently
degraded — the awaitBeforeFlush await was skipped at capture and the
loader masked like any live-lane loader, so its data arrived in the resume
stream, never the prelude. The capture lane decision is now per LOADER:

- stream:"navigation" — the BAKE lane. Executes at capture; the SETTLED
  return is shell material; nested thenables stay masked (shape is the
  liveness declaration — the #692 cross-session scar) and postpone as
  holes; the masked container registers on _shellCaptureLoaderRecords,
  holding the capture gate (bounded by ppr.captureTimeout) and pinning
  into the shell snapshot so HIT tails replay the baked value and
  hydration stays byte-agreed with the frozen prelude. The dormant
  post-#813 bake machinery (gate hold, snapshot drain, seed overlay,
  pin-first) re-engages unchanged; only the trigger moved from
  "entry lacks loading()" to the explicit per-loader flag.
- Every other loader — LIVE unconditionally, exactly as #813 left it:
  masked, postponed at loading() or an inline Suspense, boundary-less
  reads refuse the capture.

loading() is therefore OPTIONAL when every loader is flagged: nothing
masks, the shell captures complete instead of the eternal-MISS refusal.
Groups inherit through the existing awaitedLoaderIndices projection —
no group-specific code.

Red-proven: the flipped await-before-flush unit (flagged loader executes +
registers its record at capture; plain sibling never runs) and both e2e
pins fail without the capture branch (baked value absent from the prelude;
the fully-baked route degrades to eternal MISS). New pins, dev+prod:
"stream:navigation loader bakes into the shell; nested promise and plain
sibling stay live" (frozen-vs-live seqs across HITs), "fully-baked route
needs no loading()", and the group-ppr probe extended with a baked group
loader frozen in the group shell. Sweeps green: shell-cache +
shell-cache-action + prerender-ppr + semantic-matrix, 88 dev / 90 prod.
Docs: loader-container-bake.md addendum (trigger moved), feature-map PPR
rows, client-urls.md, stream option docs both DSL surfaces, fixture
doctrine header.