resolver: version-conflict detection and error reporting for transitive deps

[pablocabrera85]

Summary

Phase 3 of #68 (depends on the recursive resolution sub-issue landing). Enforce the conflict policy chosen in the design decision issue (recommended: error-on-conflict) when two skills — directly or transitively — request different tags/commits of the same repo.

Scope

• Detect when the same repo (by normalized git URL) resolves to two different commits across the dependency set.
• Surface a clear, actionable error identifying both requesters (using the lockfile provenance field) and the conflicting refs/commits, rather than silently picking one.
• Unit/integration test fixtures: a direct conflict (two top-level skills, same repo, different tags) and a transitive conflict (a nested dependency conflicting with a top-level or sibling-nested one).

Relevant code

• src/resolver.rs, src/lockfile.rs

Part of #68.

[pablocabrera85]

Amendment (post-review, see #68 "Design decisions v2"): conflict key changed from "same git" to same normalized (git, path) resolving to two different commits. Keying on git alone false-positives on the already-supported monorepo-of-skills layout (two skills, same repo, different path, different tags — not a conflict). Use the same normalize_git_url helper introduced in #78 so identity stays consistent across cycle detection, dedup, and conflict checks (single source of truth, no drift).