fix(search): bound concurrent filename-search CPU work

[royalaid]

Summary

• make search_files(target="files") default to bounded discovery order
• preserve exact global modification-time ordering behind order="modified"
• resolve installed ripgrep outside inherited PATH and avoid stale negative resolution
• refuse unsafe broad local find fallback while keeping narrow, pruned fallback behavior
• serialize same-root filename walks across concurrent file-operation instances with interrupt-safe release
• harden Windows/MSYS paths, multi-root handling, SIGPIPE, error, and ripgrep-version boundaries

Motivation

When ripgrep is unavailable on inherited PATH, concurrent filename searches can fall through to full GNU find | sort walks. Multiple sessions or a single concurrent tool batch can sustain several CPU-heavy scans at once. Modification-time sorting also defeats bounded early output on broad roots.

Behavior

• default ordering is fast, ignore-aware discovery order
• exact newest-first ordering is explicit through order="modified" and requires ripgrep 14+ or GNU find -printf
• broad local searches without ripgrep fail before an unbounded fallback walk
• same backend/root scans admit one expensive filename walk at a time; independent roots remain concurrent
• cached @ completion recency behavior is unchanged

Bounded zero-match probe

• hidden/ignored zero-match diagnostics retain --hidden --no-ignore for useful project-local ignored files, while adding both root and descendant --glob exclusions from one shared scan policy covering VCS internals, dependency/vendor trees, virtualenvs, caches, generated/build output, and backup copies
• the real search_files regression fixture confirms an ignored node_modules/package/.hidden/dependency.js is not traversed or reported while an ignored .project-local/settings.cfg remains reported
• an explicit node_modules/ root is also bounded; hidden descendants are not reported by the fallback diagnostic probe
• Defender evidence motivating this follow-up: 3,739 rg.exe scans and 47.6 seconds cumulative Defender scan duration on ignored node_modules; no machine-specific local artifact is published

Verification

• 148 passed, 2 skipped across filename-search, fallback, macOS exclusion, concurrency, and interrupt suites on native Windows
• 10 passed across focused SearchResult, path-validation, and real Git-Bash fallback classes
• pre-fix RED: the new ignored-tree regression failed because dependency.js appeared in the hidden-file warning
• post-fix direct native-Windows focused runs: zero-match/multipath 19 passed; shared subdirectory-hint policy 56 passed; filename-search CPU 13 passed; engine selection 43 passed; hidden directories 10 passed; error guard 10 passed; budget truncation 19 passed; file-operation edge cases 21 passed
• Python compilation, staged git diff --check, and final commit git diff HEAD^..HEAD --check passed
• canonical scripts/run_tests.sh was attempted with one worker, but its per-file timeout expired under local host contention before tests completed; that run is not reported as green
• the first post-push Linux CI run found the initial fixture was platform-sensitive because ordinary search could see a non-hidden dependency file; follow-up commit cc2c991de7 places that file under a hidden descendant, preserving the node_modules-pruning assertion, and its native-Windows focused run passes 19 passed
• replacement CI run 33285716521 passes the required-check gate, Python tests, Windows/macOS lanes, Python lints, Docker amd64/arm64 builds, nix, OSV, supply-chain, e2e, and repository gates; expected non-applicable jobs are skipped
• unrelated local baseline failures remain outside this change: auto-multiline has 2 failing cases, and file-operation mode/umask tests have 4 failing cases on this Windows environment
• fresh rebase onto upstream/main@aff5125f8edf5095aef5d3d79bbbb101c95b9413
• range-diff accounted for all 16 commits: 15 patch-identical, one context-only change from upstream's file_tools.py schema refactor

No new dependency is introduced. The focused fallback used the existing Hermes Python 3.11 runtime with pytest packages supplied from a temporary external test target; no test dependency was added to the repository.

[kshitijk4poor]

Triage note (perf/P2 sweep) — scope check and composition.

• Per-commit review of all 19 commits: every one is on-topic (search ordering / fallback / interrupt / test fixtures) — no dragged-in unrelated batch. Per-file histogram: tools/file_operations.py 656 lines, ~1400 in new tests, the remaining 4 source files ≤30 lines each.
• Applies cleanly to origin/main 1cb3ab6; 305 passed, 6 skipped on macOS.
• Not reproduced: the claim is CPU under concurrent find | sort fallbacks when rg is off PATH (and Windows Defender scan cost); I could not build a faithful concurrent-fallback fixture within the sweep's time box on macOS, so I am not quoting a number.
• Composition: with search_files no longer blows up memory/transport on giant single-line files (port cline#13525) #95940 (giant-line containment, same file) the hunks are adjacent only — search_files no longer blows up memory/transport on giant single-line files (port cline#13525) #95940's diff applies cleanly on top of this branch. With perf(file-ops): collapse read_file/write_file shell probes into one round-trip #95160 (probe collapse, same file, canonical for its cluster) it conflicts (imports + read path); expected order is perf(file-ops): collapse read_file/write_file shell probes into one round-trip #95160 first, then this rebases.

Method: same machine (macOS arm64, Apple M3), each PR cherry-picked onto fresh origin/main 1cb3ab6, medians of ≥5 runs unless the metric is deterministic. Scripts live in my triage workspace (bench/<name>.py, referenced below); happy to paste any of them.

[kshitijk4poor]

Merged via #101714 (rebase — all 19 of your commits landed on main with authorship preserved; my only changes were import-line conflict resolutions against #95160/#95940 which landed first). Thank you @royalaid — bounded, fail-closed search fallbacks with the shared search_policy.