fix(mcp-filesystem): add default search exclusions

[dvd233]

Summary

Closes #1258

search_files previously traversed every allowed subdirectory unless each caller supplied exclusions. That made it easy to scan dependency and build trees accidentally, producing slow searches and noisy agent context even though Agent TARS's safe directory_tree already filters those paths.

This change:

• applies the same 15 default exclusions used by the safe directory_tree (node_modules, .git, build/cache/log paths, and common metadata files);
• merges caller-provided excludePatterns with those defaults instead of replacing them;
• normalizes relative paths across platforms and preserves minimatch glob forms such as *.tmp, ?, and brace expansion;
• precompiles exclusion matchers once per search and prunes matching entries before validation or recursion;
• updates the tool and schema descriptions to make the additive exclusion behavior explicit.

The in-memory MCP tests exercise the public search_files tool against a temporary directory tree. They verify default directory/file pruning, no traversal into excluded directories, additive custom exclusions, nested globs, existing non-asterisk glob forms, and exact path-segment matching without hiding partial-name search results.

Verification

• Final regression suite against origin/main: 4 failures / 5 passes (expected red baseline).
• pnpm --filter @agent-infra/mcp-server-filesystem test: 1 suite, 9 tests pass.
• pnpm --filter @agent-infra/mcp-server-filesystem build: ESM, CJS, and declarations build successfully.
• Standalone strict TypeScript check for tests/server-in-memory.test.ts: passes.
• Prettier check for the three changed files: passes.
• ESLint for the three changed files: passes.
• Git merge-tree with the current head of fix: harden agent security checks #1906 completes without conflicts.

Checklist

• Added or updated necessary tests (Optional).
• Updated documentation to align with changes (Optional).
• Verified no breaking API changes (Optional).
• My change does not involve the above items.

[netlify]

✅ Deploy Preview for tarko canceled.

Name	Link
🔨 Latest commit	e5fe95a
🔍 Latest deploy log	https://app.netlify.com/projects/tarko/deploys/6a95919d4783700009e83ef4

[netlify]

✅ Deploy Preview for agent-tars-docs canceled.

Name	Link
🔨 Latest commit	e5fe95a
🔍 Latest deploy log	https://app.netlify.com/projects/agent-tars-docs/deploys/6a95919dc557f5000811d303

[CLAassistant]

All committers have signed the CLA.