Fix adaptive policy-block console correlation

[chubes4]

Summary

• correlate console resource-load errors against the same redacted URL representation stored in network evidence
• keep evidence-only policy blocks visible in transition diagnostics without promoting their correlated console messages into oracle findings
• cover query-bearing blocked resources and independent console errors in desktop and mobile/touch browser contexts

Root cause

Browser network capture redacts URL query values immediately, while console location.url remains raw until artifact serialization. Adaptive oracle aggregation compared those two representations exactly, so a query-bearing blocked request could be correctly classified as evidence-only network data while its correlated console error remained unmatched and became a finding.

Correlation semantics

Correlation still requires both the generic resource URL and the browser failure token to match. The URL comparison now normalizes both sides through the existing browser network URL-redaction contract. This suppresses only console messages attributable to an evidence-only policy block; independent same-URL console errors without the matching failure token remain findings.

Tests

• npx tsx --test tests/browser-adaptive-exploration.test.ts: new regression passes; 24/25 overall, with the unrelated timing-sensitive cancellation test failing because no error transition was emitted before cancellation
• isolated cancellation rerun: same unrelated failure
• npm run build: passes
• npm run check: relevant build and browser routing/security gates pass, then the existing command-registry smoke fails with wordpress.collect-workload-result outputShape should mention outputSchema id
• git diff --check: passes

Residual risks

The supplied evidence bundle reports missing_runtime_snapshot and partial replay status, so the original WordPress runtime could not be replayed deterministically. The regression instead reproduces the captured redacted-network/raw-console mismatch in real Chromium across desktop and mobile/touch contexts.

Fixes #2114