fix(path): keep the tested endpoint and its rerun exact

Description

The pitch.

One of nine independent PRs from a correctness audit of `main` at `df0b5f1`. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).

Commits: `a48455c`, `574e342`, `43713a3`

### Problem

Two ways Path evidence could name, or rerun, an endpoint other than the one
Town tested:

1. **`--url` together with `--index`.** The index entry chose the endpoint Town
   contacted, but `run.json`, the participant list and the signed receipt's
   `claim.subject` named the `--url` value. On `df0b5f1` the `--url` server
   received no requests. Even so, `verify-receipt --bundle` exited 0 and `proof`
   printed TOWN-TESTED for it.
2. **Unquoted `rerun_command`.** Pasting the recorded rerun into a shell, a URL
   containing `&` backgrounded a truncated command. It tested `...?tenant=alpha`
   under the default profile, without the pinned digest, and exited 0. Index
   paths containing spaces broke apart the same way.

### Change

- `test-agent` refuses `--url` together with `--index`, and `--index` without
  `--agent-name`, with exit 2 before any contact.
- `run_path_test` raises `ValueError` for either case.
- The rerun command is built with `shlex.join`. Plain URLs, profile refs and
  digests produce the same string as before.

### Compatibility

- No evaluator, profile or receipt-format change.
- No documented workflow used either refused combination.
- The rerun string remains POSIX-shell syntax.

### Verification

- Full suite on the branch: 822 passed.
- The new tests fail on `df0b5f1`:
  - the CLI exits 1 instead of 2;
  - the library does not raise;
  - a real `/bin/sh` exits 127 on the recorded rerun;
  - an index path is split at its space.
- Real localhost runs with the reference seller and a request-logging fixture
  server:
  - with both locators, the `--url` server sees no requests and no bundle is
    written;
  - the quoted rerun requests the same full URL under the same profile.

🤖 Generated with [Claude Code](https://claude.com/claude-code)