Bind web search to one workspace credential.
The schema is taken from web_search via functools.wraps so the built-in
and workspace-bound variants can never present different arguments. The two
also have to fail the same way: is_web_search_tool treats them as one, so
a missing package or an unusable key must return the payload the model can
act on rather than raising.
