eval: the egress audit log records full query strings, so credentials in a URL land in artifacts

Context

egress_filter.py:24 builds the path it reports by concatenating the query string:

path_query = f"{url.path}?{url.query}" if url.query else url.path

That value travels unchanged into the audit record:

# egress_filter.py:105
append_audit(rule_id, host, normalized_path)

# egress_filter.py:133-141
"normalizedPath": normalized_path[:4096],

hits.jsonl is collected as a run artifact, so any credential carried in a query string — a presigned URL signature, an api_key= parameter, a session token — is written to a file we keep and share. AGENTS.md states that secrets must never appear in logs or fixtures.

Scope

Narrower than it first looks. :105 sits inside the matched branch, so only requests that already hit a contamination rule are recorded, not all egress. Triggering a leak needs a credential-bearing URL that also matches a contamination rule. There is no evidence this has happened.

Filed as P3: real, but conditional and low impact. Worth fixing because the audit log has no use for the query string in the first place — rule attribution needs the host and path only.

Fix

Record the path without the query. Keep path_query for matching, since some contamination rules do need to inspect query parameters; only the value passed to append_audit should be stripped.

Verification

packages/eval/harbor/test_egress_filter.py already covers this module. Add a case asserting that a rule-matching URL carrying ?token=… produces an audit record whose normalizedPath contains no ?, and that rule matching itself still fires on query-only signals.