eval: the egress audit log records full query strings, so credentials in a URL land in artifacts

## Context

`egress_filter.py:24` builds the path it reports by concatenating the query string:

```python
path_query = f"{url.path}?{url.query}" if url.query else url.path
```

That value travels unchanged into the audit record:

```python
# egress_filter.py:105
append_audit(rule_id, host, normalized_path)

# egress_filter.py:133-141
"normalizedPath": normalized_path[:4096],
```

`hits.jsonl` is collected as a run artifact, so any credential carried in a query string — a presigned URL signature, an `api_key=` parameter, a session token — is written to a file we keep and share. AGENTS.md states that secrets must never appear in logs or fixtures.

## Scope

Narrower than it first looks. `:105` sits inside the `matched` branch, so only requests that already hit a contamination rule are recorded, not all egress. Triggering a leak needs a credential-bearing URL that also matches a contamination rule. There is no evidence this has happened.

Filed as **P3**: real, but conditional and low impact. Worth fixing because the audit log has no use for the query string in the first place — rule attribution needs the host and path only.

## Fix

Record the path without the query. Keep `path_query` for matching, since some contamination rules do need to inspect query parameters; only the value passed to `append_audit` should be stripped.

## Verification

`packages/eval/harbor/test_egress_filter.py` already covers this module. Add a case asserting that a rule-matching URL carrying `?token=…` produces an audit record whose `normalizedPath` contains no `?`, and that rule matching itself still fires on query-only signals.