test(observability): run the claims that admit the database and URL spans (#14526)

* test(observability): run the claims that admit the database and URL spans

Two boundary claims were carried by a membership check and a comment rather
than by exercising the thing they describe.

The SQLAlchemy scope is on the export allowlist because db.statement keeps
bound parameters as placeholders, so chat message text stays in the database.
The only test was that the scope string is in the frozenset, which passes
when the instrumentor is not installed, when instrument() raises and is
swallowed, and if a future version starts rendering literals. Now a real
sqlite engine runs a real parameterized INSERT with a sentinel row value and
the exported span is checked: db.statement comes back as
"INSERT INTO messagetable (text) VALUES (?)" and the value is absent. The
paired control runs the same probe with the value interpolated into the SQL
and asserts the sentinel IS visible, so the absence above means something.

URL redaction was covered for url.query only. http.url and url.full carry a
whole URL, and a collector endpoint documented with userinfo puts the
credential in the authority instead. Adds a span carrying both and asserts
the credential is gone from userinfo and query while scheme, host, port and
path survive. Verified out of band that the same span exports the credential
in full through a processor without the redaction.

Both gaps found by CodeRabbit on the PR that introduced them.

* test(observability): assert the placeholder and the redacted target by value

Two assertions that could pass for the wrong reason.

db.statement was checked for 'INSERT INTO messagetable', which a statement
truncated to just that would satisfy, and a truncated statement would then
satisfy the sentinel check too. Assert the bound-parameter marker itself,
'VALUES (?)'.

The userinfo probe sets http.target but nothing asserted its value, so
blanking the attribute would have passed the secret-is-absent check while
losing the route it exists to carry. Assert it comes back as '/records'.

Both from CodeRabbit on this PR.

* test(observability): fail probes with their output instead of StopIteration

Both probe runners found the PROBE_RESULT line with next(), so a probe that
exits cleanly without printing raised StopIteration and took its own stdout
and stderr with it, which is exactly the context needed to see why. Assert
instead, with both streams in the message.

Two tests also indexed spans[0] without asserting the list was non-empty, so
an empty result surfaced as an IndexError that says nothing about the cause.

Both from Copilot on this PR. Applied to the pre-existing helpers in the same
files too, since they have the same shape.