15 Playwright E2E tests covering the full ISR lifecycle:
- MISS on first request with X-Vinext-Cache header
- HIT on second request within TTL (same timestamp)
- STALE after TTL expires (same cached content)
- HIT after background regeneration completes
- Cache-Control with s-maxage and stale-while-revalidate
- Non-ISR pages have no ISR headers
- Browser rendering of ISR pages

Also documents ISR background regen bug in DISCOVERIES.md:
Pages Router regen re-caches old HTML instead of re-rendering.

- Bug cloudflare#2: hybrid build skipped Pages Router pre-rendering when App Router entry
  also present — fix: only bail out on pure App Router builds (no pages entry)
- Bug #1: getOutputPath traversal guard bypassed on Windows by backslash urlPath
  — fix: reject urlPath containing backslashes before posix normalize
- Bug cloudflare#4: double-counting in result.skipped when AbortController fires and
  res.text() throws — fix: replace await res.text() with res.body?.cancel()
- Bug cloudflare#6: dynamic routes without getStaticPaths/generateStaticParams classified
  as 'ssr' — fix: use 'unknown' (skipped for unenumerable params, not SSR APIs)
- Bug cloudflare#3: routes that throw in ssrLoadModule silently omitted from
  routeClassifications — fix: wrap in try/catch, add 'unknown' classification
- Bug cloudflare#5: buildReportRows ignored knownRoutes for API routes — fix: check
  known?.get(route.pattern) first, fall back to 'api'
- Bug cloudflare#7: dead !Array.isArray guard after try/catch in expandDynamicAppRoute
  — remove unreachable branch
- Bug cloudflare#8: middlewareHeaders spread onto 200 pre-rendered response could include
  Location header — fix: filter out 'location' before spreading
- Bug cloudflare#9: configOverride typed as Partial<NextConfig> allows unsafe non-scalar
  fields — narrow to Pick<NextConfig, 'output' | 'trailingSlash'>