Static assets ignore `next.config.js` `headers()` and middleware-set `Cache-Control`

This issue was created by an agent analysing CI failures from the Next.js Deploy Suite (vinext main vs Next.js v16.2.6, 2026-05-22).

Problem

Two related issues where static assets do not honor user-supplied Cache-Control: (1) when the user configures headers() in next.config.js to set Cache-Control: max-age=1234 for a static-asset path, vinext still returns the default public, max-age=0, must-revalidate; (2) middleware-set headers for static assets are dropped — vinext keeps the default cache-control even when middleware explicitly sets max-age=1234.

Expected: "max-age=1234" Received: "public, max-age=0, must-revalidate" (next.config headers)

Expected: "max-age=1234" Received: "public, max-age=0, must-revalidate" (middleware-set)

Estimated Impact

~2 test failures across the deploy suite.

Affected Test Suites

• test/e2e/app-dir/no-duplicate-headers-next-config/no-duplicate-headers-next-config.test.ts
• test/e2e/app-dir/no-duplicate-headers-middleware/no-duplicate-headers-middleware.test.ts

Recommendation

1. Reproduce first in vinext's own test suite. Cover both cases: headers() rule on a static-asset path, and middleware setting Cache-Control on a static-asset response.

2. Consult the headers() config when serving static assets. Run headers() rule matching for _next/static/* and other static-asset paths.

3. Allow middleware to override defaults. When middleware sets a header on a static-asset response, the middleware value must replace the default. Apply the precedence: middleware > config > default.

---

Part of #1328.