Add swappable websearch backend, make Tako search default

[jed326]

Supersedes #1175
Addresses #228 (review)

As requested in the review comment above, this PR introduces a generic, swappable backend to the websearch tool and uses Tako Search as the default backend.

All existing functionality is preserved and keyless search still works through Tako MCP. The Tako backend uses the async lane of tako-sdk for its request and response models.

Testing

• 84 unit tests across 5 files, run the way run-tool-tests.sh runs them; validate_cli_packaging.py and uv build --wheel pass. The unit tests cover the stream paths a live run can't force: a dropped stream resuming with starting_after, a non-SSE body on resume, an agent_result frame the SDK can't parse, and a stream that ends without a result, each falling through to polling the run; plus the 401 and 403 fallback from keyed to anonymous search.
• Against production from a workstation: anonymous search, keyed search (tako:api, plain, --effort deep, and --include-domain with --max-age-hours), keyed deep-research (tako:agent, 99s, $0.15), and the fallback for a bad Tako key. Parallel keyed and anonymous, the bad Anthropic key, and a blank or bogus WEBSEARCH_BACKEND were exercised before the Tako backend moved onto the SDK; that code did not change.
• From a sandbox on a local kind cluster with jed326/centaur@websearch-tako-backend as toolServer.ref (its tool tree is identical to this PR's): the shim reinstalled with the SDK dependency, websearch --help works, an ungranted principal gets tako:anonymous, and the principal with centaur-perms principals grant --tool websearch gets tako:api plus a deep-research report (tako:agent). The SDK's httpx client trusted the sandbox proxy's CA and the proxy rewrote X-API-Key. Sandbox pods never hold TAKO_API_KEY; only the per-sandbox proxy does.