For all practical intents and purposes it seems a testnet tx hex could never be valid on mainnet because of the prev tx hex present for all inputs used in the tx. However, let's say that by some miracle you had identical unspents on both testnet and mainnet. If you signed the tx and broadcast it to testnet, could you then broadcast the same tx hex to the mainnet? In other words, is there anything network specific in the tx hex? I thought there was some network magic that might go into either the signature hash or the script hash but it does not seem to be the case as far as I can tell.
Yes, it is theoretically possible for a transaction to be valid on both mainnet and testnet. Transactions don't contain any network specific information other than the previous txid and output index.