feat: add search_code tool wrapping the cs code-search engine

Add a dedicated, permission-gated search_code tool that wraps boyter/cs
(code spelunker) — a fast, relevance-ranked, structure-aware code search
engine — giving agents a better default than grep/find for exploratory
'where is X / how does Y work' searches (ranked results, snippets, ~5x
smaller payloads).

- packages/core/src/tools/search-code.ts: createSearchCodeTool factory;
  -f json invocation, workdir path containment, graceful missing-binary
  handling (DISPATCH_CS_BIN override), readable per-file formatted output.
- Wire-up: export from core; register in agent-manager (both child-whitelist
  and parent perm paths) behind new perm_search_code; add to summon catalog
  + tools enum; frontend ToolPermissions + settings.
- Docker: build a patched, statically-linked cs (pinned v3.1.0 commit) in a
  golang builder stage and bundle at /usr/local/bin/cs.
- docker/cs/luau-declarations.patch: additive Luau declaration table so
  --only-declarations / definition ranking works for Roblox .luau files
  (upstream has Lua but not Luau). Applied during the Docker build.
- Tests: new search-code.test.ts (stubbed JSON formatting + live-cs
  integration, skipped when cs absent); agent-manager/routes mocks +
  perm-gating assertions; loader pass-through.

All tests (596), biome, and tsc (core/api/frontend) pass. cs-builder Docker
stage verified to build and produce a working patched binary.

1 files changed, 19 insertions, 0 deletions

diff --git a/Dockerfile.dev b/Dockerfile.dev
index 99c6a39..52b1aa2 100644
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@@ -1,3 +1,19 @@
+# --- cs (code spelunker) builder ---
+# Builds a patched, statically-linked `cs` binary for the search_code tool.
+# Pinned to the v3.1.0 commit for reproducibility; the patch adds Luau
+# declaration support (see docker/cs/luau-declarations.patch). cs vendors its
+# dependencies, so the `go build` step is offline after the clone.
+FROM golang:1.25-bookworm AS cs-builder
+ARG CS_COMMIT=697e0bf194bbc7a4a877e5170c70618989fc92e7
+WORKDIR /build
+COPY docker/cs/luau-declarations.patch /tmp/luau-declarations.patch
+RUN git clone https://github.com/boyter/cs.git src \
+	&& cd src \
+	&& git checkout "${CS_COMMIT}" \
+	&& git apply /tmp/luau-declarations.patch \
+	&& CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o /usr/local/bin/cs . \
+	&& /usr/local/bin/cs --version
+
 FROM oven/bun:1
 
 WORKDIR /app
@@ -11,6 +27,9 @@ COPY packages/frontend/package.json packages/frontend/package.json
 # Install dependencies (cached unless package files change)
 RUN bun install
 
+# Bundle the patched `cs` code-search binary for the search_code tool
+COPY --from=cs-builder /usr/local/bin/cs /usr/local/bin/cs
+
 # Source code is volume-mounted at runtime, overriding this copy
 COPY . .