fix(file): bound fallback text search

[wylangyue]

Summary:

• use the Go fallback only when ripgrep is unavailable instead of silently retrying every ripgrep failure
• cap fallback traversal at 100,000 entries, 10,000 files, 4 MiB per file, 128 MiB total, and 10 seconds
• skip non-regular and oversized files while reporting partial-result accounting
• map cancellation, timeout, resource exhaustion, regex errors, and internal failures to structured tool errors

This prevents broad searches from performing unbounded full-file reads and avoids leaking raw transport failures when the request is canceled or a resource budget is exhausted.

Tests:

• go test ./internal/tool/file ./internal/app ./internal/mcp