fix: redact BYOC public evidence paths

[kamjcx]

Summary

• prevent BYOC demo JSON and Trace from exposing an absolute local file URI
• emit a stable synthetic repository locator and repository-relative display path
• document that adapter endpoint labels are retained in Trace and must not contain sensitive paths
• add a regression assertion covering file:// and Windows workspace paths

Scope

Developer demo/documentation hardening only. Resolver runtime, retrieval, ranking, aliases, factor records, frozen answers, and approval behavior are unchanged.

Validation

• BYOC contract tests: 5 passed on Python 3.11, 3.12, and 3.13
• targeted Ruff: PASS
• generated all-case JSON contains no file:// or D:\\ marker