resolver: recursively resolve nested ai.json with cycle-safe dedup by (git, commit, path)

Summary

Phase 2 of #68 (depends on the lockfile schema sub-issue for the target shape, and the design decision issue for the cycle/dedup contract). Implement the core recursive resolution: after resolver::resolve pins a skill to a commit, look inside the store checkout at <path>/ai.json (or repo-root ai.json) and recursively resolve its skills map too.

Scope

• Recursive resolution walks nested ai.json files found in the store checkout after a skill/plugin is pinned.
• Merge all discovered skills into one flat, deduplicated list keyed by (git, commit, path) to avoid re-cloning/re-vendoring the same skill twice.
• Visited-set cycle detection keyed by (git, commit, path) (not skill name); surface a clear error when a cycle is detected rather than looping/stack-overflowing.
• Respect the opt-in gate from the CLI/manifest flag sub-issue (transitive resolution only runs when enabled) — build against a stub/flag if that sub-issue hasn't landed yet.
• Unit/integration tests: a fixture repo tree with 2+ levels of nested ai.json, a cycle fixture, and a diamond-dependency fixture (same repo+commit reached via two paths) asserting single resolution.

Out of scope

Version-conflict policy enforcement (separate sub-issue) and vendor materialization (separate sub-issue) — this issue only produces the resolved, deduplicated set.

Relevant code

• src/resolver.rs, src/store.rs, src/manifest.rs, src/lockfile.rs

Part of #68.

Start by reading src/resolver.rs and the related store, manifest, and lockfile code, then review the lockfile-schema and cycle/dedup design issues before choosing the integration point. Add fixture coverage for two-level nesting, cycles, and diamond dependencies, with the opt-in gate respected. Done means nested skills produce one deduplicated resolved set and cycles return a clear error without looping.