• Merge pull request #865 from kaitranntt/kai/feat/862-first-class-ccs-websearch
• feat(websearch): add managed mcp runtime and provider cooldowns
• fix(websearch): close review gaps in managed runtime
• feat(websearch): finish managed third-party rollout
• fix: merge existing disallowed tool flags for websearch
• Merge remote-tracking branch 'origin/dev' into kai/feat/862-first-class-ccs-websearch
• refactor: remove duplicate copilot websearch sync
• fix: use type-only import in instance manager
• feat: add first-class CCS WebSearch runtime