fix: add default excludes and truncation sentinel to find_files

fix: expand ~ in fs tools, accept absolute glob patterns, add find_files

feat: implement secure Python sandbox with process and Docker backends

feat: implement web search and file processing tools with robust retrieval fallbacks