Preserve document path and query for fragment-only and query-only URLs #897

Parent: #267; follows #896 (authored iframe src reflection). Related #264 and unchanged Code OSS webviews.

Reproduction on the current native nested-document gate

After the authored src is preserved, WEBSCENE_NATIVE_ENGINE_TEST_FILTER=iframe-navigation-lifecycle advances past the beforeunload and detached-frame checks. Its same-origin https://iframe-navigation.test/fake.html?id=history-reload document calls history.replaceState(..., "#one"). The initial frame location.href is the expected full document URL, but after replacement it incorrectly becomes https://iframe-navigation.test/#one; pushState(..., "#two") similarly becomes the origin root. The nested history back/popstate/reload test then times out. The shared resources::resolve_url discards the current path when the authored URL is only a #fragment or ?query, impacting iframe navigation and any unchanged Code OSS webview that updates its own URL.

Focused implementation and gates

Treat fragment-only references as replacement of the base fragment, preserving the base document path and query; query-only references replace the base query and fragment while preserving path. Keep normal relative/absolute path resolution intact. Add direct native URL resolver regressions for full path, fragment, query and edge cases, and run the complete iframe-navigation-lifecycle gate on top of #896, including single-request and bounded resource/performance checks. Run related CI before merging the PR stack; keep Code OSS unchanged.