fix: enable native web tools in codeaf PlanDB tasks

[santoshkumarradha]

PlanDB task workers lost web access because their standalone session config omitted the search provider and fetcher. Bind the run profile’s live web pair in the crew factory, expose native web_search/web_fetch alongside bash, and record each action’s tool name in its trajectory. Files and PlanDB coordination continue through bash, with one tool call per response.

Reuse existing web backends, profile credentials, cancellation and output limits. The optional trajectory field preserves older records. Align both worker policies with available tools, and clarify that children inherit requirements they own without repeating their parent’s delegation instructions. Architecture and the user manual are updated in this PR.

Three review passes covered runtime wiring and logs, profile/cancellation behavior, and prompt/delegation behavior. Regression tests cover successful native actions, failed fetch observations, changing profile credentials, cancellation, conflicting action policy, and child scope.

Validation on 3deb957c698dabbea820af0017eb083923c5d780:

• make build and make pr-ready passed; all selected runner/session tests passed on their first run. All GitHub checks passed.
• Both live terminal scenarios passed: TestTUIE2E/TaskOnTheRunEngine and TestTUIE2E/TaskOnTheDefaultBelt (81 seconds total).
• A fresh delegated research task completed in 87.27 seconds ($0.02675): exactly one research child, one checker, both output files produced, and all three persisted tasks done. The checker’s three declared acceptance commands exited 0.
• All 48 generation requests across the final live scenarios had matching returned identities of OpenRouter deepseek/deepseek-v4.1-flash, including auxiliary calls. No model substitution.

Observed native actions in the final delegated task’s logs (the ask did not name tools):

Actor	Tool	Verified result
Research child	web_search	Official Go documentation results returned
Research child	web_fetch	Official Go source page text returned
Parent	PlanDB wait/resume and bash	Read the completed research and wrote the summary
Checker	Declared acceptance commands	File existence, GOMAXPROCS content, and official source URL checks passed

Earlier live coverage additionally verified independent checker fetches and rejection of a two-fetch batch followed by successful single-call retries. Native successful-action counts exclude rejected calls. Terminal tests ran against the actual application; no recording is attached.