fix(agent): bound deep research subrequests

[iamjr15]

Why

Production deep-research runs could exhaust Cloudflare's per-invocation subrequest budget. Each query launched a nested tool-using agent loop, invalid structured output retried the workflow step three times, and the outer agent could call the workflow again. The run then failed before it could package the expected PDF deliverable.

What changed

• collect a bounded provider evidence pack per query with one Exa search and at most one best-effort Firecrawl extraction
• structure each evidence pack with one tool-free model call
• cap query concurrency at three and disable workflow-step retries
• turn invalid nested structured output into a stable upstream error instead of leaking a Zod failure
• instruct the agent and deep-research skill to call the selected research workflow once per request
• document the bounded provenance and retry boundary

The existing validated citation, PDF packaging, Daytona project-file persistence, and R2 generated-output paths remain unchanged.

Architecture and migration effects

• no database or migration changes
• no environment changes
• no new provider or dependency
• moves provider network I/O out of nested agent tool loops and into the existing bounded research adapters

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build

Production acceptance will be run against the exact merged SHA after Cloudflare deployment, covering natural-language research intent, one workflow invocation, PDF delivery, project file persistence, download validity, reload persistence, and / file recall.