harden(search_code): defensive arg coercion, per-line truncation, rerun-safe pkg

Address findings from a second independent (Gemini) review covering the tool
and the packaging:

- Robustness (was: crash): non-string params from a model hallucination (e.g.
  include_ext: ["ts","go"]) threw 'x.trim is not a function' and killed the
  tool call. Add an asString() coercion for all string params (query, path,
  include_ext, exclude_pattern, only); non-strings now no-op or return the
  graceful 'query is required' error.
- Output bound: cap each rendered snippet line at 500 chars (MAX_LINE_CHARS,
  mirrors read-file.ts) so a matched minified/generated line can't bloat the
  payload. (Total output is already bounded by the universal truncator.)
- packaging/PKGBUILD: make the cs clone rerun-safe (rm -rf before clone) so
  makepkg -e / repeat runs don't abort on 'destination path already exists';
  add conflicts=('cs') to the code-search package for a clean pacman error vs.
  the unrelated AUR 'cs' that also owns /usr/bin/cs (no provides — different
  program).

Not changed (verified): path containment, the -- flag-injection guard, and the
deterministic pinned Docker build were all confirmed solid by the review.

Tests: +2 (wrong-type params don't crash; long-line truncation). Full suite
605 pass, biome + tsc green.

0 files changed, 0 insertions, 0 deletions