test(search): assert all-cooled error by exact match to clear CodeQL alert (FEAT-047)

CodeQL flagged the new all-cooled-down test's error.message.includes('https://...')
assertions as js/incomplete-url-substring-sanitization (2 high). The check is a
test assertion, not URL sanitization, but it fails the required gate. Replace the
URL-substring includes() with a single exact-match assertion on the full error
string, which also covers ordering and the no-double-space requirement. Test-only;
no production behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Codex <noreply@openai.com>

Author: 3 people

__tests__/unit/search.test.ts

@@ -2008,9 +2008,13 @@ async function runTests() {
       await performWebSearch(mockServer as any, 'all cooled');
       assert.fail('Expected all-cooled error');
     } catch (error: any) {
-      assert.ok(error.message.includes('All configured SearXNG instances are in cooldown after repeated failures'), error.message);
-      assert.ok(error.message.includes('https://cooled-one.example.com'), error.message);
-      assert.ok(error.message.includes('https://cooled-two.example.com'), error.message);
+      // Exact-match (not URL substring .includes()) so the assertion also covers
+      // ordering and the absence of double spaces, and avoids CodeQL's
+      // incomplete-url-substring-sanitization false positive on test code.
+      assert.equal(
+        error.message,
+        'All configured SearXNG instances are in cooldown after repeated failures: https://cooled-one.example.com, https://cooled-two.example.com.',
+      );
       assert.ok(!error.message.includes('  '), error.message);
     }
     assert.equal(fetchCalled, false);