fix(mcp): classify backend search timeouts

[ohdearquant]

Summary

• carry typed timeout versus backend_error causes through the coordinator service boundary
• classify both outer fan-out deadline expiry and typed runtime deadline failures without parsing rendered messages
• mark search_incomplete retryable only when every failed backend leg timed out, using the full pre-truncation failure set
• document the cause kinds and retry-admission responsibility

Verification

• cargo fmt --all -- --check
• cargo clippy -p khive-mcp -p kkernel --all-targets -- -D warnings
• cargo test -p khive-mcp -p kkernel
• deno fmt --check crates/khive-mcp/docs/api/coordinator.md

Regression tests:

• search_failure_classification_timeout_only_is_retryable_and_typed
• search_failure_classification_mixed_is_not_retryable_and_keeps_each_kind
• search_failure_classification_omitted_non_timeout_still_controls_retryability
• search_failure_classification_all_timeouts_stays_retryable_when_truncated
• backend_search_failure_classifies_typed_runtime_timeouts_without_message_matching
• coordinator_service_preserves_timeout_failure_kind

ADR-130 still describes the earlier fixed non-retryable classification; this draft leaves ADR files unchanged while implementing the newer behavior requested here.

Fixes #2069