ci(search): automate domain-credibility list refresh

[quiet-node]

Description

Makes the search domain-credibility list self-maintaining. A weekly scheduled workflow re-fetches the upstream blocklists that feed result ranking and opens a reviewable PR when they drift. The list file gains machine-managed region markers so automation can never touch the hand-curated entries.

Key changes

• scripts/refresh-credibility-list.ts: fetches the three upstream sources, rewrites only the sentinel-delimited autogen regions, guards against truncated or oversized responses, and reports (never removes) drop-list domains that no longer resolve.
• .github/workflows/credibility-list-refresh.yml: weekly Monday cron plus manual dispatch; opens or updates a PR only when the list actually changed; never auto-merges.
• src-tauri/src/websearch/credibility_domains.txt: the three upstream-derived clusters are wrapped in BEGIN/END AUTOGEN sentinels; one real refresh is applied (+7 domains). Hand-curated drop/boost/penalize entries are byte-unchanged.
• Docs: maintenance notes in docs/built-in-web-search.md and docs/search-eval.md.

Notes

• PRs opened by the workflow use the default GITHUB_TOKEN, so they do not trigger the repo's other CI; a reviewer pushes an empty commit or closes/reopens to run checks before merging.
• The eval answer-capture workflow originally scoped in Scheduled maintenance pipeline for search eval runs and credibility-list refresh #309 part 2 is descoped: the eval harnesses stay dev-machine tools.

Closes #309