refactor(router): separate authoring policy and record registration

[smiggleworth]

Route authoring now delegates path policy, scope capture, and record registration to three private modules while retaining the public overloads and synchronous definition model. Six reproduced failures are fixed: index/fallback bypassed startup locks and component validation, failed index registration consumed the page slot, and root-page fallback produced //*.

Nested group/page probes assert path composition, layout/page identity, auth and metadata order, denial before loaders, and scope unwinding after thrown definitions. Eleven of fourteen moved helper bodies are unchanged; the three changed bodies contain these fixes. Two architecture checks enforce the dependency direction, including synthetic import/reexport/dynamic-import cases.

Validation on Node 24.21.0:

• Original source and extraction both fail all six regression cases; the fixed implementation passes.
• Focused router checks pass 235 unit and 227 jsdom cases.
• npm run check passes 448 unit, 96 repository, 2,695 jsdom, 158 browser and 12 installed type cases, plus lint/types/build/publint/package artifacts. Formatting and diff checks pass.
• Three alternating 250-route registration captures: before 7.6001/7.3656/6.9310 ms; after 7.3729/7.0719/7.1866 ms, 79–87 samples, median difference -2.4%. All benchmark assertions pass; these observations are not a general speedup claim.

Ownership and behavior are documented in docs/internals/route-authoring-ownership.md; changelog and release readiness evidence are updated. Versions remain unchanged.

Closes #741.