Harden release console token bootstrap

tools/release/release-console.py

@@ -32,7 +32,9 @@ def main() -> int:
     app = create_app(workspace_root=workspace_root, token=token)
     url = f"http://{args.host}:{args.port}/"
     if token:
-        url = f"{url}?token={token}"
+        # URL fragments are never sent in HTTP requests. The WebUI transfers
+        # this one-time bootstrap token to sessionStorage and clears the hash.
+        url = f"{url}#token={token}"
     print("GovOPlaN release console")
     print(f"  workspace: {workspace_root}")
     print(f"  url:       {url}")