Route public RAG /search through the gateway — plan

Design: ../specs/2026-07-08-rag-search-gateway-design.md. TDD; pnpm check
green; land dormant (do NOT flip RAG_SEARCH_URL).

1. packages/orchestrator-types/src/tools.ts — add optional
   retryable?, retry_after_sec? to ToolResult.
2. tools/rag.ts — RagIdentity + optional ctor arg; searchHeaders()
   builds the §2 set + deterministic Idempotency-Key (sha256 of query);
   429/503 → retryable + retry_after_sec.
3. orchestrate.ts buildTools — construct RagTool from
   env("RAG_SEARCH_URL", env("RAG_BASE_URL")) + threaded identity; add
   ragIdempotencyBase param; runOrchestrator passes
   ${sessionId}:t${turn}:rag.
4. infra/env/public.env.example — document RAG_SEARCH_URL.
5. Tests — extend tests/orchestrator/tools.test.ts.

Gate pnpm check; completion + upload. Deploy: rebuild ahu-ai-chatbot-public
only, recreate ahu-public; leave RAG_SEARCH_URL unset (dormant). The gateway
cutover (setting RAG_SEARCH_URL=…:8200) + observatory verification is Efran's
operational flip.