Injected client crashes on route navigation with TypeError (_JsonMap is not a subtype of List<Object?>) — page renders blank, no error surfaces to app (Flutter 3.44.5)

## Environment

- Flutter 3.44.5 (stable), Dart 3.12.2, Framework f94f4fc76b, Engine 83675ed276
- macOS (Darwin 25.5), Chrome (current stable)
- Reproduced with both `flutter run -d web-server` (no Dart Debug Extension) and `-d chrome` via VS Code
- Frontend server runs with the (now mandatory) DDC library bundle format: `--dartdevc-canary --dartdevc-module-format=ddc`. `--no-web-experimental-hot-reload` no longer changes this (deprecated no-op), so there is no opt-out.

## Symptom

In a **debug** web build of a large multi-package Flutter app (go_router), navigating from a list screen to a detail route (`context.goNamed(...)` → route with a plain `builder:`) causes:

- the new page to render **completely blank** (URL updates, shell/sidebar still visible),
- all subsequent pointer interaction to go dead until a full browser reload,
- **no Flutter exception anywhere** — we subscribed to the VM service `Extension` stream and `Flutter.Error` never fires; the app's own `debugPrint`s stop at that moment,
- the only console artifact is the injected client crashing at exactly that navigation:

```
Unhandled error detected in the injected client.js script.

TypeError: Instance of '_JsonMap': type '_JsonMap' is not a subtype of type 'List'
at Rti._generalAsCheckImplementation [as _as] (client.js:2729)
at Rti._installSpecializedAsCheck (client.js:2664)
at BuiltJsonSerializers._deserialize$3 (client.js:20953)
at BuiltJsonSerializers.deserialize$2$specifiedType (client.js:20938)
at BuiltJsonSerializers.deserialize$1 (client.js:20946)
at Object._deserializeEvent (client.js:9920)
at client.js:26905
at _wrapJsFunctionForAsync_closure.$protected (client.js:3893)
... (stream/zone plumbing frames)
```

So the client dies deserializing an event from the debug service (`_deserializeEvent` received a JSON object where a `List` was expected — looks like a `BatchedEvents`-shaped payload mismatch), and after that the route's code never runs/paints.

## Evidence that this is tooling, not app code

- `ext.flutter.debugDumpRenderTree` on the blank page shows the route's subtree stuck `NEEDS-LAYOUT` / `size: MISSING` while ancestors are laid out; `ext.flutter.debugPaint` still repaints the rest of the UI (frame pipeline alive).
- The **same commit, same data, same browser** in `--release` (and `--profile`) renders the detail route perfectly.
- Reproduced across two independent branches of the app; also unaffected by go_router version (17.0.0 vs 17.3.0 both fail in debug).
- Everything worked on Flutter 3.38.x; the regression appeared after upgrading the app to 3.44.5.

## What we couldn't do

- Produce a minimal repro so far — in our app it reproduces 100% of the time on this navigation, but it's a large app (multi-package workspace, go_router shell + subroutes, Firebase). Happy to run instrumented builds / patched dwds against it to help narrow this down.
- Find an opt-out: `--no-web-experimental-hot-reload` is accepted but the frontend server still runs `--dartdevc-canary --dartdevc-module-format=ddc`.

## Possibly related

- flutter/flutter#189432 (web hot reload hangs via reloadSources on 3.44.5 — same subsystem, different symptom)
- dart-lang/webdev#2424 (older "UI components not rendering" injected-client report)