fix(sdk): block real network in test context, strip query from HttpError message

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/plugin-sdk/test/http.test.ts

@@ -104,6 +104,22 @@ describe("http client", () => {
   });
 });
 
+describe("safety", () => {
+  test("HttpError message does not leak the query string", async () => {
+    const { fetchImpl } = seq(res(404, {}));
+    const http = createHttpClient({ userAgent: "t/1", fetchImpl, sleep: async () => {} });
+    const err = (await http.json("https://x.test/a?api_key=SECRET").catch((e) => e)) as HttpError;
+    expect(err).toBeInstanceOf(HttpError);
+    expect(err.message).not.toContain("SECRET");
+    expect(err.message).toContain("https://x.test/a");
+  });
+
+  test("createTestContext without fetch never hits the network", async () => {
+    const ctx = createTestContext();
+    await expect(ctx.http.json("https://x.test/a")).rejects.toThrow("createTestContext: no fetch provided");
+  });
+});
+
 describe("testing harness", () => {
   test("fixture routes match by full url or url without query; unknown throws", async () => {
     const fx = createFixtureHttp({