harden(search_code): defensive arg coercion, per-line truncation, rerun-safe pkg

Address findings from a second independent (Gemini) review covering the tool
and the packaging:

- Robustness (was: crash): non-string params from a model hallucination (e.g.
  include_ext: ["ts","go"]) threw 'x.trim is not a function' and killed the
  tool call. Add an asString() coercion for all string params (query, path,
  include_ext, exclude_pattern, only); non-strings now no-op or return the
  graceful 'query is required' error.
- Output bound: cap each rendered snippet line at 500 chars (MAX_LINE_CHARS,
  mirrors read-file.ts) so a matched minified/generated line can't bloat the
  payload. (Total output is already bounded by the universal truncator.)
- packaging/PKGBUILD: make the cs clone rerun-safe (rm -rf before clone) so
  makepkg -e / repeat runs don't abort on 'destination path already exists';
  add conflicts=('cs') to the code-search package for a clean pacman error vs.
  the unrelated AUR 'cs' that also owns /usr/bin/cs (no provides — different
  program).

Not changed (verified): path containment, the -- flag-injection guard, and the
deterministic pinned Docker build were all confirmed solid by the review.

Tests: +2 (wrong-type params don't crash; long-line truncation). Full suite
605 pass, biome + tsc green.

1 files changed, 11 insertions, 0 deletions

diff --git a/packaging/PKGBUILD b/packaging/PKGBUILD
index 4fd96d2..8918a30 100644
--- a/packaging/PKGBUILD
+++ b/packaging/PKGBUILD
@@ -65,6 +65,13 @@ build() {
 	# Clone the pinned cs commit, apply the Luau declaration patch, and build a
 	# statically-linked binary. cs vendors its deps, so `go build -mod=vendor`
 	# needs no network beyond the clone. Mirrors the Docker cs-builder stage.
+	#
+	# rm -rf first so a rerun (makepkg -e, or two invocations without -C) that
+	# reuses $srcdir doesn't abort on "destination path already exists". This
+	# PKGBUILD intentionally avoids source=() (the s6 service files share
+	# basenames and would collide in $srcdir), so we clone here rather than via
+	# makepkg's VCS source handling.
+	rm -rf "${srcdir}/cs-src"
 	git clone https://github.com/boyter/cs.git "${srcdir}/cs-src"
 	cd "${srcdir}/cs-src"
 	git checkout "${_cs_commit}"
@@ -237,6 +244,10 @@ package_dispatch-s6() {
 package_code-search() {
 	pkgdesc='code spelunker (cs) — fast, relevance-ranked code search CLI (patched for Luau)'
 	depends=()
+	# Both this package and the unrelated AUR `cs` (a colored ls) own /usr/bin/cs;
+	# declare the conflict so pacman reports it cleanly instead of a raw file
+	# collision. We do NOT `provides=('cs')` — this is a different program.
+	conflicts=('cs')
 	url='https://github.com/boyter/cs'
 
 	install -Dm755 "${srcdir}/cs" "${pkgdir}/usr/bin/cs"