Allow replace (not push) when trackQuery updates the query

## Context (updated for current API)
The atomic-router `QuerySync` API is replaced by the zod-based `trackQuery` (`packages/core/lib/track-query.ts`). Its `enter` / `exit` events target `controls.navigate` but **always push** — they don't forward `replace`, even though `NavigatePayload` already supports `replace: true` (`packages/core/lib/types.ts`).

## Request
Let `trackQuery` write query updates with `history.replace` instead of `push`, so repeated query changes don't pollute the history stack and back navigation returns to the previous route.

## Direction
- Expose a `replace` option on `trackQuery` (or per `enter`/`exit`) that forwards `replace: true` into `navigate`.

## Traceability
Source: atomic-router/atomic-router#73 — https://github.com/atomic-router/atomic-router/issues/73