feat(callout): route web-search requests through filtered subrequests

[leseb]

Parent: #879

Depends on praxis-proxy/praxis#1074 and praxis-proxy/praxis#1092. The reusable executor was introduced by praxis-proxy/praxis#1073.

Summary

The shared web-search client used by OpenAI Responses and Anthropic Messages sends provider requests directly through the low-level subrequest transport. Migrate it to the filtered-subrequest executor and a configured outbound chain.

User-scoped credential and attribution policy remains tracked separately in #880.

Scope

• Migrate the shared web-search SearchClient to execute provider requests through a prebuilt outbound filter chain.
• Apply the migration to both OpenAI Responses and Anthropic Messages web-search paths.
• Add an outbound-chain reference to the web-search configuration.
• Preserve provider request/response translation, static service credentials, failure policy, deadlines, response limits, and aggregate call budgets.
• Preserve destination authority, DNS/SSRF validation, TLS/SNI, and Host handling.

Acceptance Criteria

• OpenAI and Anthropic web-search provider requests use the configured outbound chain.
• Existing provider parsing and open/closed failure behavior remain unchanged.
• Static service credentials remain usable without request-scoped credential projection.
• Configuration validation fails when the outbound chain cannot be built.
• Unit tests cover success, rejection, timeout, provider failure, and oversized response behavior.
• Integration tests prove an observable outbound filter runs for both OpenAI and Anthropic web-search requests.