scan --range rejects abbreviated commit hashes shown in help and README

### Description

`disclosure scan --range` does not accept abbreviated commit hashes, even though both the CLI help and README demonstrate a range such as `abc123..def456`.

`gitops.resolveRef` accepts a full 40-character hash or a named ref, then ends with a comment saying it will try an abbreviated hash—but that lookup is not implemented and the function immediately returns an error.

### Reproduction

From a checkout with at least three commits:

```sh
BASE=$(git rev-parse --short=7 HEAD~2)
HEAD=$(git rev-parse --short=7 HEAD)
disclosure scan --range="$BASE..$HEAD" --format=json
```

Tested against `chaoss/disclosure` at `24c489f8d857fc82906cdcc32fbe257bd7a0c81d`, using:

```text
90877f4..24c489f
```

The command fails with exit code 2:

```text
error: resolving base "90877f4": cannot resolve "90877f4" to a commit
```

Using the corresponding full 40-character hashes succeeds.

### Expected behavior

A unique abbreviated commit hash should resolve the same way Git resolves it. Ambiguous and nonexistent prefixes should return clear errors.

### Suggested scope

- Resolve unique abbreviated object IDs in `gitops.resolveRef`.
- Reject ambiguous prefixes rather than choosing one arbitrarily.
- Add range tests covering abbreviated base and head hashes, plus ambiguous/nonexistent input.
- Keep full hashes and named refs working unchanged.

I found this while looking for another small contribution after #104. I have not started an implementation so the resolution semantics can be agreed first.

### AI assistance disclosure

I used an AI coding assistant to inspect the resolver and tests, search the issue/PR backlog for duplicates, reproduce the failure locally, and help draft this report. I reviewed the relevant code and personally verified both the failing abbreviated-hash case and the successful full-hash case.

Start at gitops.resolveRef and the existing range tests, then reproduce the abbreviated-hash command from the issue. Done means unique abbreviated commit hashes work for both range endpoints, ambiguous and nonexistent prefixes return clear errors, and full hashes and named refs remain working.

Written by the indexing model from the issue text.