Cloudflare Web Search is a new zero-config Workers binding. Declared
in wrangler.jsonc as a single object (there is exactly one shared web
corpus, so no namespace/instance/setting is required):

  { "web_search": { "binding": "WEBSEARCH" } }

At runtime the binding exposes a single `search()` method that returns
URLs and catalog metadata. The binding is always-remote -- Miniflare
proxies to the production Web Search service via the remote-bindings
transport.

A new top-level CLI command is also added:

  wrangler websearch search "cloudflare workers" [--limit N] [--json]

which calls the public REST endpoint `POST /accounts/:id/websearch/search`
directly (no Worker required).

Changes in this PR:

@cloudflare/workers-utils
* environment.ts: `web_search` field (single-object shape)
* config.ts: default value
* validation.ts: `ConfigBindingFieldName` entry, friendly-name maps,
  `notInheritable` registration using `validateNamedSimpleBinding`,
  `safeBindings` entry
* worker.ts: `CfWebSearch` interface
* types.ts: `web_search` entries in `WorkerMetadataBinding` and
  `Binding` discriminated unions
* map-worker-metadata-bindings.ts: `case "web_search":` arm
* config/binding-local-support.ts: register `web_search` as
  `DO-NOT-USE-this-resource-will-never-have-a-local-simulator`
* tests: validation tests for the new field

wrangler
* deployment-bundle/create-worker-upload-form.ts: extract + serialise
  into the upload metadata
* api/startDevWorker/utils.ts: config-to-bindings + metadata-to-bindings
  switches
* deploy/config-diffs.ts: `reorderableBindings` and
  `singleBindingFields` entries
* deploy/check-remote-secrets-override.ts: switch case
* dev/miniflare/index.ts: `WorkerOptionsBindings` pick, extract,
  `warnOrError`, pass to miniflare options
* type-generation/index.ts: emit `WebSearch` runtime type in both
  type-generation entry points
* user/user.ts: add `websearch.run` OAuth scope (dot, not colon -- matches
  Bach source-of-truth)
* user/whoami.ts: handle dot-separated OAuth scopes in the expected-scope
  diff (previous code split on ':' then re-joined with ':', producing
  `websearch.run:undefined` which never matched the expected literal)
* utils/print-bindings.ts: extract + render in startup banner; always
  remote (matches ai_search/ai_search_namespace pattern)
* websearch/{types,client,index,search}.ts: new `wrangler websearch search`
  command, calling REST `/accounts/:id/websearch/search`. Field names mirror
  the REST API (snake_case); the Worker binding stays camelCase per workerd
  type defs.
* core/teams.d.ts: add "Product: Web Search" entry
* utils/add-created-resource-config.ts: exclude `web_search` from
  `ValidKeys` (singleton binding)

miniflare
* plugins/web-search/index.ts: new always-remote proxy plugin
* plugins/index.ts: register the plugin in PLUGINS, intersect
  WorkerOptions, re-export

Companion changes land in workerd (Web Search type definitions) and
edgeworker-config-service (binding kind + pipeline stage).