[codex] Add unified search controls

[MyPrototypeWhat]

Summary

Adds the unified search controls layer that was planned for search_references and provider-backed retrieval:

• adds SDK/core support for controls, provider capability declarations, applied/ignored controls metadata, and a core dedupe hook
• extends MCP search_references input/output schemas with controls, explain/meta information, provider status, filter compatibility, and readable failure feedback
• maps the unified controls into the existing provider packages while preserving legacy filters fallback behavior
• documents the SDK/MCP dual path, unified controls, provider capabilities, and search metadata

Impact

Callers get one stable control contract instead of needing to know each provider native parameter names. Provider packages remain responsible for translating supported controls into provider-specific query parameters, and unsupported controls are surfaced in metadata instead of silently pretending they applied.

Validation

• pnpm typecheck
• pnpm test:run
• pnpm build
• git diff --check

A local re-review found no Critical or Important blocking issues; only follow-up polish was noted for skipped-provider control metadata wording and Brave moderate safety mapping.