feat: add target resolution CLI dogfood surface

[jlitola]

Summary

• Add githits resolve <name> as a CLI-only dogfood surface for package and GitHub repository target resolution.
• Add an internal resolver service with shared authentication, refresh, transport, and error classification.
• Keep best and protectedMatches on a lightweight GraphQL reference fragment while fetching full fields only for ranked candidates, keeping the production query below the complexity limit.
• Render neutral numbered candidates, ambiguity-safe follow-ups, protected-name markers, trust evidence, stable JSON, and sanitized terminal text.
• Add auto-login metadata, command/container wiring, durable implementation documentation, changelog impact, and source/built smoke coverage.

Production dogfooding

• Text and detailed JSON resolution now succeed against production; the original query was rejected at complexity 711 against the production limit of 500.
• A 36-case popular-package matrix across every supported registry selected the expected package in 25 cases.
• npm, PyPI, Hex, Crates, NuGet, vcpkg, and RubyGems passed 3/3. Remaining Maven, Go, Zig, Packagist, and Swift relevance failures were recorded in the backend issue tracker with exact reproductions.
• Roughly 50 resolver calls produced no resolver protocol, schema, complexity, or rate-limit errors. Observed latency was about 550-1010 ms per call; this is not a volume benchmark.

Validation

• bun test: 2,716 passed, 0 failed, 7,748 expectations across 160 files.
• bun run typecheck, bun run format:check, and bun run lint passed.
• Root and @githits/mcp builds passed.
• Public-package validation passed; generated plugin assets validated.
• bun run smoke:cli: 76 steps passed, including authenticated resolve text and JSON.
• bun run smoke:mcp: 38 steps passed. A later rerun hit an expected production RATE_LIMITED envelope on the existing back-to-back get_example probes; direct calls succeeded after the returned retry window.
• Built CLI unauthenticated smoke passed 10 steps; built MCP registration smoke passed.
• Five-round retained Fable review loop finished clean with all findings resolved.

Release posture

• Keep this PR draft. Do not publish githits resolve until the production relevance, ambiguity wording, expected-volume latency/rate-limit, and linked-repository trust-evidence gates in docs/implementation/cli-commands.md clear.
• The pending githits impact is minor. @githits/mcp remains unchanged because Phase 1 exports resolver helpers only through the workspace-only internal surface.
• MCP resolve_target, agent instructions, parity smoke, and agent eval are explicitly deferred to Phase 2 after CLI dogfooding.