fix(han-research): say whether web search ran in every research report

[mxriverlynn]

Summary

• The research-analyst agent now notices when WebSearch is not offered to it (or a call is refused), gathers by fetch alone, and opens its return with one fixed **Web search:** line: used, or not available. ….
• The research skill copies that line into every report's Summary directly under Confidence, protects it from the readability rewrite, passes it to the validator, and on any run where the value is not used adds a completeness check to the validator's charter and a fixed Remaining Risks entry. A missing line renders as not reported. … and gets the same treatment.
• Nothing else moves: the agent's tools: line, the skill's allowed-tools: line, the A# registry shape, and han-core/agents/adversarial-validator.md are unchanged. The long-form docs say what happens without search and that the shipped agent cannot be given a different search tool (a plugin agent cannot carry its own MCP server, and its tools: list cannot name a server the plugin does not know).
• The plan behind this, with the decision log and current-state findings, is in docs/plans/gh-212-research-websearch-fallback/. Three things were deferred with reopening triggers: the GitHub/npm/PyPI fetch fallback chain, named MCP search patterns in tools:, and a config setting naming a search tool.

Why

On a Claude Code install backed by Amazon Bedrock (confirmed by the official docs; the reporter says Vertex too) the WebSearch tool does not exist. A subagent's tools: list only narrows, so the unmatched entry was dropped silently and the analyst ran on WebFetch alone while its report read like a full survey. Nothing captured the fact at its origin and no downstream rule keyed on it. Fixes #212.

How to verify

• npm run lint passes.
• With this branch as the local marketplace source, dispatch han-research:research-analyst directly on an Anthropic-backed install: the first line of its return is **Web search:** used.
• Run /research small on the same install: the report's Summary shows - **Web search:** used directly under Confidence, byte-identical after the readability pass, and the closing chat message says nothing about web search.
• Read Step 6 of han-research/skills/research/SKILL.md against an imagined analyst return with no line: it yields the not reported literal, and Step 7 then includes the completeness sentence.
• Open item, non-blocking: on a Bedrock install, /research small should render the not available line. Nobody on this project has one; the issue's reporter does, and asking them to paste a Summary is the concrete check.

Risk / rollback

Low risk; markdown-only, revert via git revert. The one thing to watch for is a Bedrock report carrying Web search: used, which would mean the analyst did not take the no-search branch there (the protocol names both triggers, absent-from-list and refused-on-call, so it should hold under either observation).