feat: add WarpGrep (Morph) as optional code search provider

[DhruvBhatia0]

Summary

• Adds WarpGrep as an optional, supplemental code search backend for the answer engine
• Follows the existing Serper integration pattern: env-var gated (MORPH_API_KEY), factory closure, Option field in RetrievalService
• WarpGrep is a multi-turn agentic search agent that performs local grep/read/list_directory operations against the repo, returning relevant code spans
• Tantivy code search remains the primary backend; WarpGrep results are merged and deduplicated. Completions are unaffected

How it works

1. User sets MORPH_API_KEY (and optionally MORPH_API_ENDPOINT, MORPH_MODEL)
2. On startup, webserver.rs creates a WarpGrepService via factory closure from serve.rs
3. In RetrievalService::collect_relevant_code(), after Tantivy search, WarpGrep runs as a supplemental search
4. WarpGrep sends the repo file tree + query to the Morph API, receives XML tool calls, executes them locally, and returns code spans
5. Results are merged with Tantivy hits, deduplicated by (filepath, start_line), and sorted by RRF score

Files changed

File	Change
crates/tabby/src/services/warpgrep/mod.rs	New — WarpGrepService, multi-turn search loop, file tree builder
crates/tabby/src/services/warpgrep/tool_executor.rs	New — Local tool execution (grep, read, list_dir), XML parsing
crates/tabby-common/src/api/code.rs	Added WarpGrepSearch trait
crates/tabby/src/serve.rs	Added factory closure to ws.attach()
ee/tabby-webserver/src/webserver.rs	MORPH_API_KEY env check, passes to retrieval
ee/tabby-webserver/src/service/retrieval.rs	Added warpgrep field, supplemental search in collect_relevant_code()
ee/.../answer.rs, thread.rs, page.rs	Updated test call sites with None warpgrep param

Security

• Path traversal protection via canonicalize() + prefix check on all tool executor paths
• Fixed-string grep (-F) to prevent ReDoS from LLM-supplied patterns
• UTF-8 safe string truncation (char boundary aware)
• 30s HTTP timeout on Morph API calls

Test plan

• cargo check passes on tabby-common, tabby, tabby-webserver
• cargo fmt --check clean
• cargo clippy clean (no new warnings)
• 7/7 warpgrep unit tests pass (XML parsing, finish output, line ranges, tool responses)
• 4/4 retrieval tests pass (existing tests updated with new param)
• No ast-grep lint violations

Closes #4452