feat: add Exa AI-powered search tool

[tgonzalezc5]

Summary

• Adds a new web_search tool that uses Exa for AI-powered web search, complementing the existing web_fetch (which reads a known URL).
• Surfaces neural / fast / instant / deep search modes, the six Exa categories (company, research paper, news, personal site, financial report, people), domain include/exclude lists, text include/exclude phrases, date ranges, and user_location biasing.
• Returns ranked results with cascading content modes — highlights, summary, and full text can be requested simultaneously, and the result snippet falls back through them.
• Registered eagerly in the dry-run and CLI catalogs and lazily in create_claw_agent so the SDK is only imported on first use.
• exa-py is an optional dependency under a new exa extra; EXA_API_KEY is added to the sensitive-env strip list in LocalBackend so sandboxed exec cannot leak it.

Usage

from clawagents.tools.exa_search import ExaSearchTool

tool = ExaSearchTool()
result = await tool.execute({
    "query": "rust async runtime benchmarks",
    "type": "neural",
    "category": "research paper",
    "include_domains": "arxiv.org,openreview.net",
    "highlights": True,
    "summary": True,
    "num_results": 5,
})
print(result.output)

Set EXA_API_KEY in the environment (see .env.example) and install with pip install 'clawagents[exa]'.

Files changed

• src/clawagents/tools/exa_search.py — new tool, typed ExaSearchResult dataclass, parsing + formatting helpers
• src/clawagents/agent.py — lazy _LazyExaSearch registration alongside _LazyWebFetch
• src/clawagents/__main__.py, src/clawagents/dry_run.py — eager catalog registration
• src/clawagents/sandbox/local.py — add EXA_API_KEY to _SENSITIVE_ENV_KEYS
• pyproject.toml — new exa optional extra, also bundled into all
• .env.example — documented EXA_API_KEY block
• tests/test_exa_search.py — 20 unit tests covering parsing, snippet fallback, validation, kwargs forwarding, and tracking-header injection

Test plan

• pytest tests/test_exa_search.py — 20 tests passing locally (parsing, fallback, validation, mock-target accuracy, header injection)
• pytest tests/test_web_fetch_ssrf.py tests/test_tools_comprehensive.py — 49 adjacent tests still green
• mypy src/clawagents/tools/exa_search.py — clean
• Smoke check: _tool_catalog() includes web_search with all 16 parameters
• CI run on the upstream branch (couldn't be exercised from a fork locally)