feat(agent): add web_search tool for web discovery

Summary

• Adds a web_search tool to the agent, enabling autonomous web discovery alongside the existing web_fetch (which retrieves known URLs)
• Supports dual-engine search: Brave Search API (when BRAVE_SEARCH_API_KEY is set) with automatic fallback to DuckDuckGo HTML (no API key needed — always works)
• Includes domain filtering (allowedDomains/blockedDomains), time-range filtering (day/week/month/year), URL deduplication, and structured result output

Motivation

The agent currently has web_fetch for retrieving specific URLs but no way to discover information. Without search, the agent cannot:

• Research error messages or unfamiliar libraries
• Find documentation, tutorials, or API references
• Discover solutions on StackOverflow, GitHub issues, or dev blogs
• Look up the latest version or breaking changes for packages

web_search fills this gap — the agent can now search the web, then use web_fetch to dive deeper into specific results.

Changes

Features

• Dual-engine: Auto-detects Brave Search API key, falls back to DuckDuckGo HTML
• Domain filtering: allowedDomains to scope results, blockedDomains to exclude sites
• Time-range filtering: Maps day/week/month/year to each engine's native format
• Deduplication: Normalizes URLs (protocol, trailing slashes) to remove duplicates
• HTML entity decoding: Lightweight decoder for DuckDuckGo HTML output
• No new dependencies: Uses curl inside the sandbox (same pattern as web_fetch)

Test plan

• 27 unit tests pass (parsers, filters, deduplication, time range mapping)
• Typecheck passes across all 4 packages
• Lint/format check passes (ultracite)
• Integration test with live sandbox (requires sandbox environment)