Track App Router hash-only entries in traversal metadata model

[NathanDrake2406]

Context

Follow-up from #1248 and the broader #726 navigation lifecycle work. PR #1248 models App Router traversal intent conservatively and treats metadata-less entries as unknown, which is safe for the current #726-CORE-18/19 slice.

One remaining gap is hash-only App Router navigation. navigateClientSide() currently short-circuits hash-only changes by calling pushHistoryStateWithoutNotify(null, "", fullHref) or replaceHistoryStateWithoutNotify(null, "", fullHref), then committing client state without going through the new traversal metadata writer/index allocator.

That means app-owned hash-only entries are intentionally metadata-less today. They traverse safely as unknown, but this weakens the future claim that App Router-owned history entries all carry vinext traversal metadata.

Desired follow-up

Before traversal direction becomes semantic, decide and implement one of these:

1. Explicitly document hash-only entries as intentionally metadata-less and always unknown, or
2. Route hash-only App Router history writes through the same metadata writer/index allocator used by approved RSC commits.

Acceptance criteria

• Hash-only App Router entries have a deliberate traversal metadata contract.
• Back/forward traversal over hash-only entries has focused browser coverage.
• The implementation does not let unapproved RSC work mutate browser-visible route state.
• The planner remains small and only consumes explicit traversal intent.

References

• Parent architecture issue: App Router layout persistence: Route Manifest and Navigation Planner architecture #726
• Follow-up source PR: fix(app-router): model RSC redirect and traversal lifecycle #1248