feat(worker-search): per-task search allowlist + fetch chain override (Phase 3 #38)

[charlie83Gs]

Summary

• ProviderRegistry.search_all() gains optional allowlist: Iterable[str] | None — filters the registered providers to the ids named, preserves legacy behaviour when omitted.
• FetchProviderRegistry.fetch_many() gains optional chain: list[str] | None — applies the override to every URI in the batch.
• web_search task resolves state.services.graph_config(graph_id) and threads composition.search_providers + composition.fetch_chain into both calls. Falls back to registry defaults when no composition is available.

Why

First consumer-side wire-up for Phase 3 — proves per-task provider selection driven by GraphTypeComposition works end-to-end before rolling it into every pipeline phase.

Unknown ids in the allowlist are skipped silently so a graph type can declare providers that haven't rolled to every deployment yet. Empty allowlist → zero results (explicit over implicit).

Part of #38. Follow-ups will apply the same pattern to decompose_page_wf, ingest_build_wf, and node_pipeline_wf.

Test plan

• uv run --project libs/kt-providers pytest libs/kt-providers/tests/test_providers.py libs/kt-providers/tests/fetch/test_registry.py -x -q — 30/30 green (4 new allowlist tests + 2 new fetch_many chain tests)
• uv run --project libs/kt-providers pytest libs/kt-providers/tests/ --ignore=tests/integration -x -q — 170/170 green
• uv run --project services/worker-search pytest services/worker-search/tests/ -x -q — 4/4 green
• CI: full workspace tests

🤖 Generated with Claude Code

[charlie83Gs]

Review fixes pushed. All priority items applied:

1. Fail-fast resolver (ci: add CI/CD pipelines for testing, releases, and Docker builds #1): removed the except Exception fallback around state.services.graph_config in web_search. A running graph with a composition MUST route through its authorized providers — silently widening on a resolver hiccup could leak search queries through providers the tenant never authorized. Errors propagate; the task fails and ops see the bug. Matches CLAUDE.md fail-fast rule.
2. Docstring fix (fix: resolve cross-worker test imports and enforce unit/integration test boundaries #2): search_all docstring now reflects reality — iteration is registration order, not composition order. Dedup by URI keeps the visible ordering stable.
3. Worker-search test (feat: integration test pipeline with containerized services #3): extracted _resolve_composition_selectors(state, graph_id) helper + 4 tests covering composition→allowlist/chain happy path, graph_id=None fallback, services=None fallback, and the must-have resolver-raises-propagates assertion (pinning the authorization invariant).
4. Zero-match warn (perf: optimize CI test execution with parallelization and change detection #4, optional): skipped for now — composition validation at registration time is the better place for this (already via validate_all_graph_types); runtime warn would duplicate the signal. Can revisit if ops ask.

Other notes:

• conftest.py added to services/worker-search/tests/ installing the fake Hatchet env so workflows.search module import doesn't require a real token. Mirrors pattern in services/worker-nodes.
• All 8 worker-search unit tests green; 172/172 kt-providers tests green.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}