feat(tools/io): 内置 IO/网络工具（file(路径安全)/http(SSRF防护)/web-search/web-fetch/knowledge）+ 大小截断

plugins/tools/io/doc.go

@@ -0,0 +1,25 @@
+// Package io implements the built-in I/O and network tools for Cyrene v2
+// (DevDocs/design/09-插件生态.md). It exposes file, http, web-search, web-fetch
+// and knowledge as pkg/plugins/sdk.Tool values, wired to the process-internal
+// config, logger and runtime/memory retriever.
+//
+// Build the full configured tool set with New(cfg, opts...). Tools() and
+// Register(reg) are convenience wrappers that use platform defaults; production
+// wiring should call New(cfg, opts...) so the tools honor the real DataDir,
+// search endpoint and knowledge retriever.
+//
+// Security constraints
+//
+//   - file: every path is cleaned and validated to stay inside the configured
+//     data directory or an explicit whitelist; ".." traversal and symlink escape
+//     are rejected; reads and writes are size-capped.
+//   - http: GET/POST only, timeouts, response truncation and SSRF protection
+//     (loopback/private/link-local addresses and localhost are refused unless
+//     the host is on an explicit allowlist).
+//   - web-search: requires a configured search endpoint, otherwise a clear error.
+//   - web-fetch: size- and content-type-limited readable text extraction.
+//   - knowledge: RAG lookup over the runtime memory retriever; a clear message
+//     when no knowledge base is configured.
+//
+// All tools are safe for concurrent use, as required by sdk.Tool.
+package io