The default FencedFrameConfig(url) constructor does not install a fenced frame config in the spec. FencedFrameConfig(url) puts a url into the url slot, and then we can pass in either a url or urn to the navigate algorithm. The navigate algorithm only creates a fenced frame config struct and sets the target fenced frame config if the value passed in is a urn. So, if we pass in a url to that algorithm instead, no fenced frame config will be created, and no fenced frame config instance will be created either, so the fenced frame won't have access to window.fence.

This should create a fenced frame config + install a fenced frame config instance unconditionally, but that is not what is happening currently.