feat(callout): route OGX file-search requests through filtered subrequests

[leseb]

Parent: #879

Depends on praxis-proxy/praxis#1074 and praxis-proxy/praxis#1092. The reusable executor was introduced by praxis-proxy/praxis#1073.

Summary

openai_file_search_callout sends OGX vector-store searches directly through the low-level subrequest transport. Migrate every vector-store search request to a configured outbound filter chain.

User-scoped credential and attribution policy remains tracked separately in #880.

Scope

• Execute OGX vector-store search requests through the filtered-subrequest executor.
• Add an outbound-chain reference to openai_file_search_callout configuration.
• Preserve bounded fan-out, concurrency, aggregate response budgets, continuation behavior, result aggregation, deadlines, and failure policy.
• Preserve existing static service credentials.
• Preserve destination authority, DNS/SSRF validation, TLS/SNI, and Host handling.

Acceptance Criteria

• Every OGX vector-store search request uses the configured outbound chain.
• Fan-out concurrency and aggregate size/call limits remain bounded.
• Search continuation and aggregation behavior remain unchanged.
• Configuration validation fails when the outbound chain cannot be built.
• Unit tests cover parallel searches, rejection, timeout, partial failure, and aggregate limits.
• Integration tests prove an observable outbound filter runs for each vector-store request.