tracking(runtime): finish provider-native web search

## Problem

#2152 established provider-hosted WebSearch for OpenAI Responses and Anthropic
Messages, but the remaining provider wires and verification gaps are split
between documentation and isolated issues or pull requests. There is no single
place to track ordering, shared invariants, and completion.

This is a coordination tracker. Existing provider-specific work remains
authoritative and should be linked rather than reopened.

## Desired outcome

Every provider in the capability matrix has an explicit, fail-closed status.
Supported adapters execute search in the primary model request and preserve
provider events, citations, durable replay data, credential isolation,
privacy-mode removal, scoped tool ceilings, and explicit no-fallback behavior.

## Checklist

- [ ] Reconcile or supersede the stale effective-wire follow-up #2179
- [ ] Complete Alibaba/Qwen through #3163 and #3685; do not reopen duplicate #3680
- [ ] Reconcile DeepSeek restoration across #3689, #3694, and #4107
- [ ] Live-verify the existing MiniMax Anthropic-compatible route
- [ ] Add opt-in Anthropic `web_search_20260209`; retain `20250305` as baseline
- [ ] Add Gemini grounding with Google Search
- [ ] Add the Z.AI native model tool; exclude its standalone Search API
- [ ] Add the OpenRouter web plugin
- [ ] Define cost/result-row contracts, then add Mistral Agents and Groq Compound
- [ ] Gate every adapter by exact provider/model/wire and cover lowering, streamed results, citations, replay, privacy, tool ceilings, and no fallback

## Non-goals

- Replacing Tavily or adding silent fallback
- Inferring hosted search from generic protocol compatibility
- Adding Z.AI's standalone Search API to the model-native path
- Reopening work already owned by provider-specific issues or PRs
- Provider-native Tool Search for large catalogs (#1382)

## Documentation

- [Provider-hosted web search capability](https://github.com/apache/maka/blob/main/docs/web-search-provider-capability.md)

Start with docs/web-search-provider-capability.md and the provider-specific issues and pull requests listed in the checklist, preserving their ownership and status. Reconcile the capability matrix and stale follow-ups first; done means every provider has an explicit fail-closed status and the listed event, citation, replay, privacy, ceiling, and no-fallback checks are covered.

Written by the indexing model from the issue text.