Summary

Fixes #54077

When middleware is active (even a no-op NextResponse.next()), router.query loses dynamic route parameters during client-side navigation in production builds.

Root cause: After getRouteInfo() processes middleware, the change() method re-extracts dynamic params using routeInfo.resolvedAs (the middleware-processed path). This path may not match the route pattern (e.g., /users/[userId]/test), so getRouteMatcher returns false and the params are dropped from query.

Fix: When the middleware-resolved path doesn't match the route pattern, fall back to extracting params from the original as URL — the URL the user intended to navigate to, which always matches the route pattern.

Reproduction

1. Create a Pages Router app with a dynamic route (/users/[userId]/test)
2. Add any middleware (even empty NextResponse.next())
3. Navigate to /users/user1/test
4. Call router.push({ pathname: router.pathname, query: { ...router.query, step: '1' } })
5. In production: router.query loses userId, URL shows /users/[userId]/test?step=1

Test plan

• New e2e test: test/e2e/middleware-query-params-navigation/ — verifies dynamic params survive router.push with spread router.query when middleware is active
• Passes in both production (test-start-turbo) and development (test-dev-turbo) modes
• Existing middleware dynamic route tests pass (12/12 in middleware-general)
• Existing middleware rewrite tests pass (59/59 in middleware-rewrites)
• 2 pre-existing failures in middleware-general (shallow linking) confirmed unrelated — fail on canary without this change