fix(replay): step through Path bundles instead of crashing

Description

The pitch.

Follow-up found while reviewing the merged `00a013b`, raised by Codex.

### Problem

`nandatown replay <bundle>` crashed on every Path bundle, before printing
anything:

```
AttributeError: 'PathProfile' object has no attribute 'name'
```

`render_replay` named the profile with `profile.name`, which only Track and Lab
profiles have. Reproduced on `main` with a bundle recorded by `nandatown
test-agent` against `nandatown a2a serve` on localhost. `verify`, `report` and
`visualize` handled the same bundle correctly.

### Change

Replay names a Path profile by its exact reference, such as
`a2a-capability-fulfillment@0.3`, using the same expression `verify` uses to
check the run's profile name. Nothing else changes.

Replay is a viewer. It neither evaluates nor writes, and `render_replay` is
imported only by `cli.cmd_replay`, so recorded evaluator results and
verification are untouched.

### Verification

- **Regression test through the CLI.** It records a Path bundle with `nandatown
  test-agent` against the reference A2A agent in its own process on localhost,
  then replays it with `nandatown replay`. It checks:
  - the header names the recorded profile, and every event is printed;
  - `--kind` and `--limit` filter as they should;
  - no bundle file changes;
  - `nandatown verify` still passes.

  It fails on `main` with the reported `AttributeError`. A second test checks
  that Track and Lab replay headers are unchanged.
- **Full suite:** 1,569 passed.
- **Independent review.** The reviewer built 53 bundles through the CLI:
  - every Path profile, passing and against each planted defect;
  - Path runs whose resolution failed;
  - all eight Track profiles and seven Lab scenarios;
  - the genuine historical fixtures.

  They replayed each one 12 ways through both CLI entry points, 1,908 runs with
  no failures. Track and Lab output is byte-identical to `main`, and every
  bundle's files and `verify` result are unchanged. They found no other command
  that crashes on Path bundles.

### Notes for integration

- **With #280:** once both merge, `replay` of a Path bundle recorded before
  #280 withholds its credentials, as `report` does. #280 applies that
  withholding in `replay.py`. The two branches merge cleanly, and replaying
  #280's old credential fixture with both merged shows no secret.
- **Out of scope, not changed:** these options behave as on `main`:
  - a negative `--limit` drops events from the end;
  - a negative `--start` counts from the end;
  - a `--kind` that matches nothing prints only the header and verdict.

🤖 Generated with [Claude Code](https://claude.com/claude-code)