Angular SSR route-policy confusion can expose client-only data under public cache headers

### Description

Angular SSR can select server-route metadata from one route while Angular Router renders a different route when the request URL contains certain ambiguous path forms.

Example:

```text
/profile;
/profile//public
```

In both cases, a route configured as `RenderMode.Client` can be unexpectedly rendered on the server while inheriting public cache headers from another `ServerRoute`.

### Minimal Reproduction

### Minimal configuration

```ts
import { RenderMode, ServerRoute } from '@angular/ssr';

export const serverRoutes: ServerRoute[] = [
{
path: 'profile',
renderMode: RenderMode.Client,
headers: {
'Cache-Control': 'private, no-store',
},
},
{
path: 'profile/public',
renderMode: RenderMode.Server,
headers: {
'Cache-Control': 'public, max-age=300',
},
},
{
path: '**',
renderMode: RenderMode.Server,
headers: {
'Cache-Control': 'public, max-age=300',
},
},
];
```

The `/profile` component reads a benign request-derived marker through the SSR `REQUEST` token.

### Steps to reproduce

Request the normal client-only route:

```bash
curl -i \
-H 'Cookie: session=PRIVATE_VALUE' \
http://localhost:4000/profile
```

The initial HTML does not contain the request-derived value.

Request either crafted path:

```bash
curl -i \
-H 'Cookie: session=PRIVATE_VALUE' \
'http://localhost:4000/profile;'
```

```bash
curl -i \
-H 'Cookie: session=PRIVATE_VALUE' \
http://localhost:4000/profile//public
```

### Actual behavior

The crafted requests can:

- render the `/profile` component on the server;
- expose request-derived data in the initial HTML;
- apply `Cache-Control: public` metadata belonging to another server route.

### Expected behavior

The route used to select `renderMode`, status, and response headers must always correspond to the route whose body is rendered.

A route configured as `RenderMode.Client` should not be server-rendered through an alternative URL representation.

### Your Environment

```text
Angular 22.X
```

### Anything else relevant?

This was previously reported at https://issuetracker.google.com/u/1/issues/518988455

Comece reproduzindo a divergência com as duas requisições curl e a configuração mínima de ServerRoute. Rastreie como o Angular SSR seleciona renderMode e response headers para /profile; e como o Angular Router renderiza /profile; e /profile//public. O trabalho estará concluído quando o body renderizado, renderMode e os headers de cache sempre corresponderem à mesma rota, sem que nenhum valor derivado da requisição seja exposto para a client-only route.

Escrita pelo modelo de indexação a partir do texto da issue.