also looking at this

feat: router and runtime audit fixes

#1656

Closed fingersandmind wants to merge fix/router-and-runtime-audit-fixes into main

3 files +87 -42

ed231134d9 fix(router): resolve race conditions, cache key mismatches, and active link conflicts devjan review this step
f2444a078b feat(router): add scroll restoration and meta tag swapping on navigation devjan review this step
4d2574defc fix(signals): patch listener leak, query cache bounds, and @html XSS risk devjan review this step
d87b008608 fix(hydration): clear timeout on success and guard JSON.parse for props devjan review this step