fix(marketplace): resolve marketplace check against each entry's host + token

[leocamello]

Description

apm marketplace check built a single default-host RefResolver with no token and called list_remote_refs(entry.source), ignoring each entry's effective host. After #1736 a relative source under marketplace.sourceBase parses as host=None with the bare relative source (the base is composed only on the build/pack path, which check doesn't share), so check ran git ls-remote https://github.com/<relative>.git and failed with exit 128 for every sourceBase entry — and for the pre-existing #1288 host.tld/owner/repo form — even when apm pack against the same apm.yml succeeded.

check now mirrors the builder's routing: it composes a host-less source onto sourceBase (via the shared split_source_base), honours per-entry host overrides, resolves the host's token through a shared marketplace/auth_helpers.resolve_token_for_host, and short-circuits local ./ packages before any network call. Default-host entries are unchanged.

Verified end-to-end against a real self-managed GitLab: the exit-128 case now resolves against the composed nested path.

Fixes #1762

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

Adds three check regressions in tests/unit/commands/test_marketplace_check.py: composed → base host + token, host-prefixed override → github, local → zero ls-remote. uv run pytest tests/unit/marketplace tests/unit/commands is green (2607 passed); ruff check / ruff format --check clean.

Spec conformance (OpenAPM v0.1)

• N/A -- this PR does not change OpenAPM-observable behaviour.

(src/apm_cli/marketplace/ and commands/marketplace/ are not Mode-B critical paths; no normative requirement changes.)