TrailAggregator.query(trail_label=...) silently returns all trails for an unknown label

## Summary `TrailAggregator.query(trail_label=...)` silently falls back to querying **all** registered trails when the given label doesn't exist, instead of returning an empty result (or raising). `TrailAggregator.get_trail()` handles the same situation correctly. ## Current behavior ```python # src/provena/aggregator.py targets = ( {trail_label: self._trails[trail_label]} if trail_label and trail_label in self._trails else self._trails ) ``` Verified: ```python agg.add("agent1", trail1) agg.add("agent2", trail2) agg.query(trail_label="nonexistent_agent") # -> returns records from BOTH agent1 and agent2 agg.get_trail("nonexistent_agent") # -> None (correct) ``` When `trail_label` is truthy but not a registered key, the condition is `False`, so `targets` falls back to `self._trails` (every trail) instead of an empty mapping. ## Expected behavior An unknown `trail_label` should restrict the query to nothing (empty result), matching the behavior of `get_trail()` for the same input. E.g. `self._trails.get(trail_label) if trail_label else self._trails`, wrapped to produce `{trail_label: trail}` only when found, else `{}`. ## Why This inverts the caller's intent: someone filtering by a specific agent's trail (e.g. a typo'd label, or a label from a trail that hasn't registered yet) silently gets data from every agent instead of nothing — exactly the kind of governance-query bug that's hard to notice because it doesn't error, it just returns plausible-looking data from the wrong scope. **Difficulty:** Trivial — one-line fix in `src/provena/aggregator.py`. `tests/test_aggregator.py` currently only tests the valid-label path; add a case for an unknown label.