fix(search): bounded, fail-closed search_files fallbacks with shared engine/ordering policy (salvage #97770)

[kshitijk4poor]

Summary

search_files gets a bounded, fail-closed fallback path when rg is unavailable or a probe finds nothing: a shared agent/search_policy.py decides engine + ordering, filename walks are serialised per root, heavy trees are pruned from the zero-match probe, and the Windows/find fallback normalises its paths — so no-rg hosts stop burning CPU on concurrent unbounded walks.

Salvaged from #97770 by @royalaid (all 19 commits cherry-picked, authorship preserved) onto current main; every conflict was import-line merging against #95160/#95940 which landed first.

Who hits this / when / why it matters

Installs without rg (Windows without Git-for-Windows extras, minimal containers) and any host where a filename search walks a large tree: the previous fallbacks ran unbounded find walks concurrently per call and could return partial results silently on error.

What changed (19 commits, on-topic per-commit — search ordering / fallback / interrupt)

• agent/search_policy.py (new): engine selection + "fast discovery" file ordering, shared by the tool and the code sandbox.
• tools/file_operations.py: fallback scans unified and fail-closed (partial errors rejected, explicit roots preserved), bounded rg SIGPIPE accepted, root options terminated, dash-prefixed and macOS-glob roots handled, filename walks serialised by root, admission-cancellation race closed.
• agent/subdirectory_hints.py: heavy trees pruned from the zero-match probe.
• Tests: test_search_files_engine_selection.py, test_search_files_cpu_windows.py (new) + interrupt-publisher hardening.

Verification

• Touched tests + the file-ops suites (test_file_ops_single_roundtrip, edge_cases, read_unicode_filename_retry): 370 passed, 8 skipped; ruff clean.
• Composition with perf(file-ops): collapse read_file/write_file shell probes into one round-trip #95160 (already on main): read_file bench unchanged (2 MB page 1 → 1 exec / 84 ms), native≡shell parity harness 20/20 identical.
• Composition with search_files no longer blows up memory/transport on giant single-line files (port cline#13525) #95940 (already on main): its --max-columns hunks are outside this PR's ranges; both apply.
• Claimed CPU regression (Windows Defender + concurrent find fallbacks) was not reproducible on macOS in the triage window; the fail-closed/bounded behaviour is verified by the new tests.

Provenance

Salvaged from #97770 by @royalaid — 19 commits cherry-picked with authorship preserved (noreply email). My only changes are the import-line conflict resolutions inside the cherry-picks.