resolver: version-conflict detection and error reporting for transitive deps

Summary

Phase 3 of #68 (depends on the recursive resolution sub-issue landing). Enforce the conflict policy chosen in the design decision issue (recommended: error-on-conflict) when two skills — directly or transitively — request different tags/commits of the same repo.

Scope

• Detect when the same repo (by normalized git URL) resolves to two different commits across the dependency set.
• Surface a clear, actionable error identifying both requesters (using the lockfile provenance field) and the conflicting refs/commits, rather than silently picking one.
• Unit/integration test fixtures: a direct conflict (two top-level skills, same repo, different tags) and a transitive conflict (a nested dependency conflicting with a top-level or sibling-nested one).

Relevant code

• src/resolver.rs, src/lockfile.rs

Part of #68.

Start by reading src/resolver.rs and src/lockfile.rs, along with the recursive resolution work and conflict-policy design from #68. Add coverage for direct and transitive conflicts, including both requesters and their conflicting tags or commits, then run the unit and integration tests to verify the actionable error and avoid silent selection.