fix: gate websearch providers and toolgroup on API key presence (#503)

## Summary

- Gate `brave-search` and `tavily-search` tool_runtime providers behind their respective API keys (`BRAVE_SEARCH_API_KEY`, `TAVILY_SEARCH_API_KEY`) using the existing `${env.VAR:+value}` conditional activation pattern
- Without these keys set, the search providers are not registered at all, reducing the indirect prompt injection surface
- The `builtin::websearch` tool_group remains registered but is inert without the `tavily-search` provider (OGX does not support conditional `${env.VAR:+value}` gating on `toolgroup_id` — it resolves to `None` and fails Pydantic validation)

## Test plan

- [ ] Deploy with no `TAVILY_SEARCH_API_KEY` or `BRAVE_SEARCH_API_KEY` set — verify websearch providers are not registered
- [ ] Deploy with `TAVILY_SEARCH_API_KEY` set — verify `tavily-search` provider and `builtin::websearch` toolgroup are active
- [ ] Deploy with `BRAVE_SEARCH_API_KEY` set — verify `brave-search` provider is active
- [ ] Verify existing smoke/integration tests pass (they don't use websearch)

🤖 Generated with [Claude Code](https://claude.com/claude-code)


## Summary by CodeRabbit

* **Configuration**
  * Web search providers (Brave Search and Tavily Search) are now disabled by default.
  * Brave Search is enabled only when `BRAVE_SEARCH_API_KEY` is set.
  * Tavily Search is enabled only when `TAVILY_SEARCH_API_KEY` is set.
  * Provider settings still respect your configured API keys and result limits.
* **Documentation**
  * Updated setup guidance to reflect the new opt-in behavior for Brave Search and Tavily Search.



Approved-by: eoinfennessy

Approved-by: cdoern

Author: mergify[bot]