feat(agent/analyze): add pattern_search tool for catalog browsing

[nghiadaulau]

Summary

Adds a read-only tool to the analyze agent: pattern_search. It
complements pattern_history (which requires a known pattern id) by
letting the model browse the learned-pattern catalog with a small
filter / sort surface.

Why this is useful

The analyze agent's catalog-side tools today:

Existing tool	What it does	Gap
pattern_history	One pattern by id	Needs the id up front
describe_service	One service summary	Only one service at a time

That leaves no way for the model to answer questions like:

• "Are there other patterns on this service that fired recently?"
• "Show me every spike-verdict pattern in the last day."
• "Has anything matching this template ever been classified?"

The model can't list and filter the catalog without one — today it
either asks the operator or guesses ids. pattern_search closes that
gap.

Filter / sort surface

{
  "query":      "connection refused",  // case-insensitive substring on template
  "service":    "orders",              // exact, case-insensitive
  "verdict":    "spike",               // known | unknown | spike
  "rule_name":  "oom",                 // exact, case-sensitive (operator-authored ids)
  "order_by":   "count_desc",          // count_desc (default) | last_seen_desc | first_seen_desc
  "limit":      20                     // default 20, capped at 100
}

Output uses the standard ToolResult envelope. Found stays true
on zero matches (matching the convention used by recent_incidents
and recent_changes — the empty list is itself an answer). The
response carries count, total_matched, and truncated so the
model knows when to narrow.

Constraints honoured

• Strictly read-only. Only reads from PatternCatalog via the
  existing local interface in tools.go — no new imports, no storage
  mutations, no provider calls. The import-graph guard
  (TestTools_ImportGraphStaysReadOnly) passes.
• No tools.yaml changes — purely catalog-backed, no external
  config required. Registered in tools.Default next to
  pattern_history, so it's available whenever a catalog is wired —
  same zero-config story as the other catalog tools.
• No detect-mode change — analyze-only addition.
• Rebased on the find_runbook-era Default signature (embedder
  • runbooks params); both tools coexist, registration capacity 7→8.

Tests

TestDefault_PatternSearchRegistration (registration convention from
tools_default_test.go) + TestPatternSearch_* (11 cases): metadata
shape, nil catalog, bad args, invalid enums, case-insensitive query,
combined service + verdict filter, case-sensitive rule_name, both
orderings, limit truncation with total_matched/truncated,
limit clamp to 100, empty result still Found=true.

A hand-rolled in-memory fakePatternCatalog keeps the test file free
of any pkg/agent import — the analyze/tools package stays
import-cycle-free.

Docs

• src/agent/ai-analyze-mode.md — added pattern_search to the
  inline tool list.
• src/agent/analyze-tools/tools.md — per-arg reference, use-case
  prompts, and the relationship to pattern_history.

Test plan

• gofmt -l clean
• go vet ./... clean
• go build ./... clean
• go test -race -count=1 ./... green on every package
  (TestGitChangeFeed_RealRepo_Eino needs live network to clone
  cloudwego/eino and fails identically on a pristine
  upstream/main checkout in a sandboxed env — unrelated)