GitHub fallback UX: fail closed with actionable identity-resolution diagnostics #393

Follow-up to #388.

When a package's canonical repository is not the conventional github.com/{org}/{name} and GitHub REST repository search is unavailable/rate-limited, resolution must fail closed but explain exactly which safe identity paths were attempted.

Acceptance criteria:

• distinguish manifest-declared identity, conventional guess, bounded repository search, and smart-HTTP fallback in the final typed error;
• never guess across organizations or accept an ambiguous/truncated search result;
• errors suggest adding canonical repository metadata where that resolves the ambiguity;
• do not expose tokens, auth headers, signed URLs, or unbounded response bodies;
• tests cover REST-degraded + non-conventional repo name, ambiguity, bad manifest identity, and conventional success;
• consume zed-clients typed transport/rate-limit outcomes rather than parsing HTTP in the CLI.