feat: add target resolution CLI dogfood surface

[jlitola]

Summary

• Add githits resolve <name> for internal package and GitHub repository target-resolution dogfooding.
• Add a dedicated service with compact terminal and detailed JSON GraphQL selections, shared authentication/error handling, and no expensive candidate inspection.
• Render neutral numbered candidates with inline protected-name markers, descriptions, trust evidence, canonical GitHub labels, and safe ambiguous follow-ups.
• Add stable deduplicated JSON output, command/container wiring, product documentation, and source/built smoke coverage.

Safety

• Sanitize all untrusted resolver terminal values against ANSI, OSC, C0, C1, and DEL control-sequence injection, including the follow-up target.
• Keep unknown enum and ambiguity output forward-compatible without rendering backend-controlled labels directly.
• Document the separate repository-wide terminal metadata sanitization increment; raw source/document content remains outside that future slice pending an explicit content-contract decision.

Validation

• bun test - 2,618 passed after rebasing onto origin/main.
• bun run typecheck.
• Root and @githits/mcp builds.
• Built CLI unauthenticated smoke and built MCP registration smoke.
• Source smoke resolve probes passed; later authenticated get_example probes were rate-limited during the latest run.
• Independent code review found no implementation issues after fixes.

Known release gates

• This remains a draft dogfood surface and must not be published until the backend release gates in docs/plans/resolve-target.md pass.
• Bare guava currently selects the wrong Maven package without Google-specific context; the finding is recorded for backend corpus/ranker work.
• Package candidates still lack linked-repository trust metrics; tracked in githits-com/pkgseer-backend#1666. Terminal output falls back to the canonical linked repository label.