feat: add Exa AI-powered search tool

Summary

Adds an exa_search tool so the agent can do AI-powered web search alongside the existing web_fetch (which only fetches a known URL). Useful for looking up library docs the model doesn't know, finding code examples on GitHub, or researching error messages without first having to guess the right URL.

• New tool at packages/agent/tools/exa-search.ts, registered as exa_search in open-harness-agent.ts
• Direct call to https://api.exa.ai/search via fetch (no SDK dependency added)
• Reads EXA_API_KEY from env; returns a structured error when unset so the agent can fall back gracefully
• Exposes the most useful Exa knobs: type (auto/neural/fast/instant), category (incl. github for code search), numResults, includeDomains/excludeDomains, includeText/excludeText, and date-range filters
• Each result returns title, url, optional publishedDate/author, and a snippet that cascades through highlights → summary → text depending on what the API returns
• System-prompt updated with a short Web section so the model knows when to prefer exa_search over web_fetch

Example usage

// Look up library docs
exa_search({ query: "drizzle-orm migrations cli usage", numResults: 5 })

// Find a code example on GitHub
exa_search({
  query: "next.js streaming server component example",
  category: "github",
})

// Debug an error, scoped to Stack Overflow
exa_search({
  query: "TypeError Cannot read properties of undefined reading 'map' react",
  includeDomains: ["stackoverflow.com"],
})

Files changed

• packages/agent/tools/exa-search.ts — new tool
• packages/agent/tools/exa-search.test.ts — 14 unit tests
• packages/agent/tools/index.ts — export
• packages/agent/open-harness-agent.ts — register as exa_search
• packages/agent/system-prompt.ts — add a Web section listing both tools
• apps/web/.env.example — document EXA_API_KEY

Test plan

• bun run --filter @open-harness/agent typecheck — passes
• bun run typecheck (all packages) — passes
• bun run check (ultracite lint + format) — passes
• bun test packages/agent/tools/ — 37/37 pass (14 new + 23 existing)
• Tests cover: request body shape with/without optional filters; snippet fallback through highlights → summary → text; empty-content case; EXA_API_KEY unset error path; auth + x-exa-integration headers; non-2xx and thrown-error paths
• End-to-end with a live API key — not run in CI; requires EXA_API_KEY