App Router: `history.pushState` with new pathname not reflected after back/forward

> *This issue was created by an agent analysing CI failures from the [Next.js Deploy Suite](https://github.com/cloudflare/vinext/actions/runs/26282973805) (vinext `main` vs Next.js `v16.2.6`, 2026-05-22).*

## Problem

After using `history.pushState` to set a custom pathname (e.g. `/pushstate-new-pathname`), and then navigating back and forward, the pathname is lost — `usePathname()` reports an older value. Distinct from #1348 (which is about middleware rewrites) — this is shallow `pushState` + history traversal.

```
history.pushState(/pushstate-new-pathname) not preserved across back/forward
```

## Estimated Impact

~1 test failures across the deploy suite.

## Affected Test Suites

- `test/e2e/app-dir/shallow-routing/shallow-routing.test.ts`

## Recommendation

1. **Reproduce first in vinext's own test suite.** Push a shallow state with a new pathname, navigate elsewhere, then back, and assert `usePathname()` returns the originally-pushed pathname.

2. **Persist the shallow pathname in the history entry metadata.** Tie this to the history-entry restoration foundation from #1366.

---

Part of #1328.