Fix year_max returning zero results (enforce year window post-merge)

[lfnothias]

Problem

Calling search_literature (or any aggregator path) with a year_min/year_max window returned zero results, while the same query with no year filter returned papers normally.

Root cause: SciLEx expands a [year_min, year_max] window into one query per year (~26 years × N APIs via its query compositor). That fan-out blows the per-provider timeout budget, so _call_provider times out and returns [] for every provider — an in-range request paradoxically yields nothing.

Fix

In DomainAwareAggregator.search, fetch on the fast no-year provider path and enforce the [year_min, year_max] window post-merge on each paper's year, via a new _within_year_bounds helper (papers with an unknown year are kept). This is provider-independent and correct regardless of how each provider handles year filters.

Test

Adds test_year_window_enforced_post_merge_not_forwarded: in-range + unknown-year papers are kept, post-cutoff ones dropped, and the window is not forwarded to providers. All 19 aggregator unit tests pass.

Found while building the Consilium rediscovery benchmark, which needs prior-literature-only retrieval (contamination control). Note: live re-validation is currently confounded by external API rate limits (PubMed quota exhausted, Semantic Scholar 429) — the fix is covered by the unit test.

🤖 Generated with Claude Code