feat(fs-search): spawn the packaged ripgrep binary through the subprocess seam

glob/grep now run the @vscode/ripgrep binary via ctx.subprocess with a plain
argv vector: no system rg install, no shell layer, unconditional registration.
The load-time command -v rg probe and the bash-seam coupling are removed;
timeouts ride the cooperative exec.signal plus the seam's terminate
escalation. The fs-glob-sampling ACP snapshot executes the real packaged
binary against an mtime-pinned fixture. Adds the packaged-ripgrep-search
Agent Note, updates the roster-note facts and both shipped-composition e2es,
and regenerates the doc catalogs and third-party notices (surfacing
pre-existing manifest drift plus the new @vscode/ripgrep row; the notices
generator also learns pnpm 11's truncated virtual-store names).

examples/acp-agent/tests/fixtures/fs-search-bin/rg

@@ -1,10 +0,0 @@
-#!/bin/sh
-printf '%s\n' \
-  'archive/a.ts' \
-  'archive/b.ts' \
-  'archive/c.ts' \
-  'old\one' \
-  'old\two' \
-  'src/index.ts' \
-  'docs/guide.md' \
-  'test/spec.ts'