fix(fs-search): address the second-round #1119 review

- inline the collect() identity wrapper now that both streams use the
  seam's diagnostic-tail shape
- resolve the packaged rg path lazily at the first call (memoized):
  @vscode/ripgrep resolves its platform package at module evaluation, so a
  static import turned a missing/corrupt platform package into a Loader
  composition failure instead of the documented per-call SEARCH_FAILED
- classify synchronous spawn-creation throws (a NUL in argv, an abort
  racing the pre-check, a rejected resolution) into SEARCH_FAILED /
  SEARCH_ABORTED instead of leaking raw errors
- correct the stderrMaxBytes contract: the stderr excerpt is embedded in
  SEARCH_* error messages, not hidden from the model
- export virtualManifest and pin its three acceptance paths (prefix hit,
  pnpm-11 truncated-name content-scan fallback, both miss) with fixture
  unit tests

Tests: rg-path.spec.ts (resolution failure + memoized rejection),
tools.spec.ts spawn-creation classification, notices spec virtualManifest.

docs/config-catalog.md

@@ -1735,14 +1735,14 @@ export interface Config {
   rawOutputMaxBytes?: number
   /** Terminate-escalation grace period (ms) for one search process, handed to the subprocess seam. */
   graceMs?: number
-  /** Max bytes retained for one search's stderr diagnostic tail (never surfaced to the model). */
+  /** Max bytes retained for one search's stderr tail; the excerpt is embedded in `SEARCH_*` error messages, never shown on success. */
   stderrMaxBytes?: number
   /** Cooperative tool-call timeout budget (ms) on both tools, enforced by `@deepseek-ai/dsh-timeout-policy` through `exec.signal`. */
   timeoutMs?: number
 }
 ```
 
-Source: [`packages/fs/tool-fs-search/src/index.ts:71`](../packages/fs/tool-fs-search/src/index.ts)
+Source: [`packages/fs/tool-fs-search/src/index.ts:72`](../packages/fs/tool-fs-search/src/index.ts)
 
 ## `@deepseek-ai/dsh-tool-goal`