fix(lab-ops-hub): keep the empty-query marker before the fragment (#654) - #663

Fixes #654

Problem

PR #648 (#639) re-attached the empty ?/# markers as a suffix after every geturl() rebuild. When the query is empty and the fragment is non-empty, the ? therefore landed after the fragment: http://example.com/path?#frag came back as http://example.com/path#frag? — a different URL (fragment corrupted to frag?, empty query absent) than the Worker returns, on the plain, percent-decoded-host and canonical-IP return paths alike.

Solution

• New _attach_empty_query_fragment_markers(rebuilt, source_url) helper: the empty-query marker is inserted before the # that introduces a non-empty fragment in the rebuilt URL; the empty-fragment marker (fragment empty by definition) remains a suffix. ?#, ?x#, #frag?notquery and all other lab-ops-hub: container validator returns empty path, empty port and empty userinfo un-normalized — recorded URL differs from the Worker #639 cases are unchanged.
• All three rebuild sites now use it instead of geturl() + markers: _url_with_host, _normalize_validated_url and _url_with_encoded_components. The fetcher's _split_userinfo rebuild, which dropped the markers entirely, uses it too.
• Verdicts unchanged; no accept/refuse change.

Tests

• New Python test test_returns_empty_query_marker_before_a_nonempty_fragment: the issue battery plus percent-decoded / IP / userinfo / encoded-fragment arms, lab-ops-hub: container validator returns empty path, empty port and empty userinfo un-normalized — recorded URL differs from the Worker #639 controls, a _split_userinfo pin and a redirect-handler pin. Ablation exact: with only app.py reverted, only this test fails, with the exact path#frag? divergence.
• TS pin added to the lab-ops-hub: container validator returns empty path, empty port and empty userinfo un-normalized — recorded URL differs from the Worker #639 Worker test for the ?#frag spellings (Worker already returns them).
• Python 59/59 and TS 39/39 locally; ruff format clean.
• Differential vs the real Worker validator under Bun over 480 generated spellings (10 hosts × 4 paths × 12 tails, including ?#frag, ?#, ?x#frag, #frag?notquery): zero differences in verdict or returned form.

Single-repo: no validate_crawl_url/validateCrawlUrl copy in the opencode, openchamber or nix clones (git-grep clean).

^{Need help on this PR? Tag @codesmith-bot with what you need.}