Closes#12996. Part of #12986.
- websearch resolves KILO_WEBSEARCH_PROVIDER, EXA_API_KEY and
PARALLEL_API_KEY through Env.Service in the tool body and threads
them into the pure helpers; selectWebSearchProvider takes the
override as a parameter.
- mcp-websearch no longer snapshots EXA_API_KEY into a module-level
URL at import time; exaUrl(key) derives it per call, so BYOK keys
set or cleared after startup are honored.
- Tool registry provides Env.node.
- kilo-tool-process-env allowlist is now empty; check:architecture
drops from 15 to 9 classified ratchet sites.
- Transform/model tests confirmed running in-process via plain
bun test (455 tests, <1s), the other half of #12996.
warpgrep.ts, the third file in the original ratchet, was already
removed on main.