fix(trace): redact browser trace URL query data

[cssbruno]

Summary

• Fixes browser trace export so the url.path span attribute is derived from parsed path-only URL data instead of String(url).
• Drops query strings and fragments before a browser span is enqueued or posted, while leaving the actual fetch target unchanged.
• Adds a Node-backed runtime regression test that verifies a traced fetch with query secrets posts only /api/patients in the exported span payload.

Issue Closure

Fixes #777

Verification

• I ran the relevant tests, lint, and build commands.
• I ran scripts/test-go-modules.sh when Go code or compiler behavior changed.
• I ran go build ./cmd/gowdk when CLI, compiler, runtime, addon, or release behavior changed.
• I ran node --check editors/vscode/extension.js when editor files changed.
• I updated docs for behavior, setup, or architecture changes.
• I added or updated tests for changed behavior.
• I considered security-sensitive surfaces such as auth, CSRF, redirects, request-time handlers, logs, diagnostics, embedded assets, editor commands, WASM, contracts, and realtime behavior.

Commands run:

• go test ./internal/clientrt -count=1
• go build ./cmd/gowdk
• git diff --check

LLM Assistance

• LLM session summary: AI assistance changed the browser trace runtime URL attribute normalization and added an executable regression harness.
• Human-reviewed assumptions: Browser trace spans should keep only path data in url.path; the request URL used by fetch remains unchanged.
• Follow-up work: None for [High] Redact browser trace URL query data before export #777.