Reduce Sentry noise from splat route scanner POSTs

[kentcdodds]

Summary

• Adds an install-time patch for @epic-web/workshop-app so the bundled routes/$ splat route has an action and is marked as action-capable in the server manifest.
• Adds a narrow server guard for non-GET/HEAD/OPTIONS requests whose path is only repeated slashes (//, ///), covering the Sentry example without affecting normal pages or action routes.
• Adds focused node:test coverage for the patch logic and installed workshop-app build/runtime patch.

Sentry

• epicshop issue EPICSHOP-F0 / 7447885629
• Example noise: POST *splat to https://object-oriented-typescript.epicweb.dev//
• Message: You made a POST request to a catch-all route without an action for route "routes/$".

Validation

• npm run test:patch-workshop-app passes
• npm run typecheck passes
• npm run lint passes with existing import-order warnings in extra/02.inventory-manager
• Production smoke: POST //, POST ///, POST /wp-login.php, and POST /does-not-exist all return normal 404 Not Found
• Production smoke: existing action routes (POST /login, POST /resources/lookout) still reach route actions and return 400 Bad Request for missing/invalid payloads
• npm run validate:all is currently blocked before running by the existing missing root npm-run-all binary (sh: 1: npm-run-all: not found).