feat(cli): harden tool search ranking, guardrails and observability

- default engine: fielded BM25 ensemble (action_v1 remains a shadow candidate)
- add --explain score_breakdown: per-field contributions, structured
  multiplier, query classification and avoid_when penalty
- add DWS_TOOL_SEARCH_* env overrides (algorithm, k1/b, field weights,
  explain) for release-independent tuning and rollback
- tokenizer: CJK unigram+bigram so single-character intents match; align
  isToolSearchCJK with unicode.Han used by the evaluation slices
- structured routing: extend vocabularies with English synonyms,
  word-boundary matching for ASCII values, restrict the rerank gate to
  technical identifiers only
- avoid_when demotion layer wraps every lexical algorithm (Forbidden@5
  proxy 37.55% -> 0); intent-overlap matching rejected after control
  showed it demoted gold answers (Recall@5 0.8664 -> 0.7845)
- remove the OA task_id +1.00 fixture-specific multiplier
- build the default engine once per process for long-lived hosts
- evaluation baseline: intent-proxy R@5 990/1123 (88.16%); update
  integration sentinels accordingly

scripts/testdata/tool_search_eval_manifest.json

@@ -10,7 +10,7 @@
   "algorithm_freeze": {
     "state": "development_candidate_recorded_before_independent_dev_test_is_sealed",
     "diagnostic_proxy_control": "bm25_unfielded",
-    "go_runtime_default": "fielded_bm25_action_v1",
+    "go_runtime_default": "fielded_bm25_ensemble",
     "go_source_paths": [
       "internal/cli/schema_search_command.go",
       "internal/cli/tool_search.go",
@@ -26,7 +26,7 @@
     ],
     "gate_source_sha256": "6034eb08694a5355fd6cb4a270f5b4eafd5544084d4cb812192c6b3e2b391e15",
     "shadow_candidates": [
-      "fielded_bm25_ensemble",
+      "fielded_bm25_action_v1",
       "fielded_tfidf_cosine",
       "bm25plus"
     ],
@@ -41,7 +41,7 @@
     "state": "sealed_diagnostic_only",
     "catalog_generation": "go_declarations_to_runtime_assembly",
     "catalog_build_output": ".worktrees/policy-tmp/tool-search-schema-catalog",
-    "catalog_source_hash": "sha256:106a3d2389f672f7fd0ec302c45e2391e9edaac2d34523e15d42c395abb6c499",
+    "catalog_source_hash": "sha256:02c633c075f4af915ea097d383bdcbc25fe549c172e2d3336152e30cf2906e80",
     "catalog_surface_hash": "sha256:7f9839f1ff428b52f1d032d2fa6493815c3755650b7d9fa653839e7d589482e5",
     "tool_count": 1098,
     "workflow_path": "scripts/testdata/tool_search_workflows.json",