0.136.1: The emulation log no longer holds page addresses

humanish 0.136.1 keeps page addresses out of a mobile-emulated participant's emulation log. The
log held the full address of each tab the emulation holder reloaded or attached to, query string
and fragment included, and run.json keeps up to 50 of its lines. A one-time code or token in a URL
the participant opened could reach a share_ready bundle, since verify's text scan does not read a
short query value as a secret. The log now names the tab's target id and the commands sent.

Fixes

• A mobile-emulated participant's emulation log in run.json no longer holds the addresses of the tabs it reloaded or attached to. The holder logged each address in full, query string and fragment included, and run.json keeps up to 50 of those lines as desktopGeometry.fidelity.holderLog, scrubbed for the run's known values only. A one-time code or token in a URL the participant opened could reach a share_ready bundle, since verify's text scan does not read a short query value as a secret. The holder now logs the target id and the commands it sent. (#1904)

Checked live

A mobile-emulated hosted participant followed a link that opens a new tab at next.html?ref=<random value>#part, on 0.136.0 and on this release in parallel:

	0.136.0	0.136.1
holderLog lines	2	2
Lines with a url key	1: {"reloaded": "<target>", "url": "http://127.0.0.1:8000/next.html?ref=<value>#part", "by": "href"}	0
Run files holding the value	run.json, observer/observer-data.json, observer/index.html	none
verify	local_only (raw screenshots)	local_only (raw screenshots)

Both participants passed at 414 px. On 0.136.0 verify did not flag the value.

Dependencies

The lockfile moves to @e2b/desktop 2.5.0, e2b 2.56.0 and playwright-core 1.64, with 11 development and site bumps (#1902). The published package's ranges do not change, so a fresh install of 0.136.0 already resolved these versions. A hosted try-live run, a desktop participant and a mobile-emulated participant passed on them.

The release changes nothing a participant sees or does and nothing the analysis reads, so the efficacy benchmark was not rerun; the 0.133.0 result stands.