feat: add Exa AI-powered search tool

[tgonzalezc5]

Summary

• Adds exa_search as a built-in tool, giving automatons the ability to search the web via the Exa AI-powered search engine
• Supports neural, fast, and auto search types with content modes (highlights, text, summary, or all)
• Exposes key Exa features: category filtering (company, news, research paper, etc.), domain include/exclude, text include/exclude, and date range filtering
• Results are routed through the existing EXTERNAL_SOURCE_TOOLS sanitization pipeline for injection defense
• Gracefully degrades when EXA_API_KEY is not set (returns a helpful message instead of erroring)

Usage

// The tool is automatically available when EXA_API_KEY is set
// Example tool call from the agent:
{
  "name": "exa_search",
  "arguments": {
    "query": "latest developments in autonomous AI agents",
    "search_type": "neural",
    "num_results": 5,
    "content_mode": "highlights",
    "category": "research paper",
    "start_date": "2024-01-01"
  }
}

Files Changed

• src/agent/exa-search.ts — New module: Exa API client with typed interfaces, content builder, snippet extraction, and result formatting
• src/agent/tools.ts — Registers exa_search as a built-in tool with full parameter schema; adds to EXTERNAL_SOURCE_TOOLS for sanitization
• src/__tests__/exa-search.test.ts — 18 unit tests covering API response parsing, snippet fallback logic, request body construction, error handling, disabled state, and tool registration
• src/__tests__/tools-security.test.ts — Adds expected risk level classification for the new tool

Test Plan

• TypeScript type-check passes (tsc --noEmit)
• All 18 new exa-search tests pass
• Existing tools-security tests pass (71/71) with new tool classification
• Snippet fallback cascades correctly: highlights -> summary -> text -> placeholder
• Tool returns user-friendly message when EXA_API_KEY is unset
• Request includes x-exa-integration: automaton tracking header
• Large responses are truncated at 15,000 characters