fix(cache): bound unstable cache fill ownership

[james-elicx]

Follow-up stack 2/3. Exact head: 5b5cbf23219c039deb7ad0c384d419a3fda437f8. Base: #3099.

This layer hardens the same-isolate unstable_cache() replacement-fill coordinator introduced by the parent:

• assigns publication ownership to the active fill
• prevents an expired or cancelled owner from overwriting a replacement result
• uses a bounded lease so a stalled computation cannot block the key forever
• distinguishes a computing owner from one already publishing to the adapter
• bounds retained pending-fill state by entry count and total key characters
• stores fixed-size key tokens in temporary bypass state

The focused tests cover owner expiry, replacement publication, stalled publication, waiter replay, and state bounds.

Validation before the split:

• targeted cache/runtime tests green
• ppr-impact-demo workerd E2E green

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original
workers-cache	preview	production
web	preview	production

[github-actions]

Performance benchmarks

Compared 5b5cbf2 against base 2bfabdc using alternating same-runner rounds. Next.js was unchanged and skipped.

0 improved · 0 regressed · 6 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	142.3 KB	142.2 KB	⚫ -0.0%
Client entry size (gzip)	vinext	129.5 KB	129.5 KB	⚫ -0.0%
Dev server cold start	vinext	3.17 s	3.18 s	⚫ +0.2%
Production build time	vinext	3.46 s	3.43 s	⚫ -0.6%
RSC entry closure size (gzip)	vinext	117.9 KB	117.9 KB	⚫ -0.0%
Server bundle size (gzip)	vinext	199.7 KB	199.7 KB	⚫ -0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@3100

npm i https://pkg.pr.new/create-vinext-app@3100

npm i https://pkg.pr.new/@vinext/types@3100

npm i https://pkg.pr.new/vinext@3100

commit: 5b5cbf2

[james-elicx]

Closing this layer because the reviewed cross-request cold-miss coordinator diverged from current Next.js behavior. #3099 now retains only the safe envelope migration and request-owned invalid-publication checks; with coalescing removed, this stalled-fill ownership layer has no valid role.