[BUG] marketplace check ignores GITHUB_APM_PAT for default-host owner/repo sources

Describe the bug

apm marketplace check does not use GITHUB_APM_PAT when a marketplace package uses the default-host <owner>/<repo> source format.

The command passes host=None to its resolver for these entries.
The host=None branch creates RefResolver(offline=offline) without resolving authentication through AuthResolver.
As a result, private GitHub repositories fail during git ls-remote unless Git happens to have ambient credentials.

In contrast, apm pack resolves the same entries successfully with the same GITHUB_APM_PAT, because the pack path resolves GitHub authentication before creating its ref resolver.

To Reproduce

1. Create an apm.yml with a private GitHub package that uses the default-host shorthand:

   name: marketplace-check-auth-reproduction
   version: 1.0.0
   description: Reproduces marketplace check authentication behavior
   author: example
   license: MIT
   type: hybrid
   
   marketplace:
     name: marketplace-check-auth-reproduction
     description: Reproduces marketplace check authentication behavior
     version: 1.0.0
     owner:
       name: example
     packages:
       - name: private-package
         source: example-org/private-package
         ref: v1.0.0
   

2. Run the check for a repository on GitHub.com with a valid token and no ambient Git credentials.
   For example, use a clean GitHub Actions runner after actions/checkout runs with persist-credentials: false.
   Alternatively, disable global and system Git configuration for the command:

   export GITHUB_APM_PAT="{TOKEN}"
   GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 apm marketplace check --verbose
   

3. Observe that the package fails with a Git authentication error during ls-remote.

4. Run the pack command with the same environment:

   GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 apm pack --dry-run
   

5. Observe that APM reaches the repository and resolves the ref successfully.

Expected behavior

apm marketplace check uses the standard AuthResolver chain for default-host <owner>/<repo> sources.

Per the documentation:

• Consumer Authentication and Authentication Guide: GITHUB_APM_PAT is the primary environment credential for GitHub-class hosts in CI and automation.
• CLI Reference: apm marketplace: Under "Trust boundary", APM forwards authentication tokens (GITHUB_APM_PAT, GITLAB_APM_PAT, ADO_APM_PAT) whenever the host is classified as GitHub, GitLab, or Azure DevOps.
• Publish to a Marketplace: apm marketplace check validates that every package ref resolves as a pre-release gate before apm pack builds artifacts.

When GITHUB_APM_PAT is set, marketplace check and pack should authenticate consistently and resolve the same private GitHub entries.

Environment (please complete the following information):

• OS: Ubuntu (ubuntu-latest GitHub Actions runner) and macOS.
• Python Version: 3.12 in GitHub Actions.
• APM Version: 0.29.0.
  The same resolver branch remains present on the current main branch, which declares version 0.30.0.
• VSCode Version (if relevant): Not applicable.

Logs

The affected workflow reports this error for each private remote entry:

Git authentication failed during ls-remote
[x] 18 entries have issues

All 9 local entries pass.
Running apm pack immediately afterward with the same GITHUB_APM_PAT successfully authenticates to the remote repositories.

Additional context

The relevant behavior appears in src/apm_cli/commands/marketplace/check.py.

_entry_coordinates() returns host=None for a default-host <owner>/<repo> source when marketplace.sourceBase is not set.
_resolver_for() then selects this branch:

if host is None:
    resolvers[key] = RefResolver(offline=offline)

The code comment above this branch describes the behavior as: "Default-host entries keep the bare ambient-credential path."
The branch for an explicit host resolves credentials through resolve_auth_for_host() and passes the resulting token and authentication context to RefResolver.

Resolving host=None through APM's configurable default_host() and applying the same authentication-resolution path used by MarketplaceBuilder._get_resolver() would make the commands consistent without breaking GitHub Enterprise Server configurations (GITHUB_HOST).

Documentation alignment:

• Manifest Schema - Section 7.5 marketplace.packages: Documents <owner>/<repo> as the standard format for remote packages on the default host.
• A manifest-level workaround using marketplace.sourceBase is not equivalent for existing GitHub shorthand sources. sourceBase requires a full HTTPS base with at least one path segment (e.g. https://github.com/example-org) and requires changing sources from example-org/repository to relative repository names, changing the generated marketplace source representation.

A temporary downstream workaround is to provide a GitHub-scoped Authorization header through an isolated Git configuration only while apm marketplace check runs.

Start in src/apm_cli/commands/marketplace/check.py, reading _entry_coordinates() and _resolver_for(), then compare their host=None path with MarketplaceBuilder._get_resolver() and resolve_auth_for_host(). Reproduce the private default-host source case with GITHUB_APM_PAT and isolated Git configuration. Done means marketplace check resolves the same shorthand entries as apm pack while preserving GitHub Enterprise configurations.