feat(search): add provider-native web search

[hqhq1025]

Summary

• add one unified WebSearch routing layer that selects either the current model provider or explicit Tavily execution
• implement OpenAI Responses web_search and Anthropic Messages web_search_20250305, including durable provider call/result replay and citation metadata
• connect Desktop, CLI/TUI, Runtime Host, and opt-in Headless Harbor while preserving privacy mode and scoped child tool ceilings
• derive web_research child availability from the selected session model and search policy
• document the provider capability matrix, dual-wire selection, persistence model, and verification evidence

Verification

• npm run build:test
• npm run typecheck
• npm run lint
• npm run format:check
• focused core/runtime tests for capability routing, canonical read-model projection, context budgeting, fallback backfill, citations, and second-turn provider replay
• focused CLI, Desktop, Runtime Host, and Headless Harbor composition tests
• real AI SDK HTTP wire conformance for second-turn Anthropic server_tool_use + web_search_tool_result and Responses item-reference replay

Earlier live DeepSeek smoke runs completed on both Responses and Anthropic-compatible wires across CLI and Headless. A later review rerun timed out before either endpoint returned its first model event; deterministic provider-wire coverage remains green and no later live result is claimed.

Review focus

Provider-native results deliberately keep a normalized result for UI/read models and opaque providerOutput for protocol replay. The raw replay payload is counted by context budgeting, is never partially archived, and is dropped from fallback replay when unavailable rather than being reconstructed from the display projection.