Resolve merged candidate snippets

[danielporterda]

What changed

• resolves a merged candidate through GitHub's merge commit
• rejects an open candidate outside preview with an explicit error

Why

Squash-merged source PRs cannot provide their final commit hash before merge. The authored PR identity remains stable; production resolution uses the merge commit GitHub reports afterward.

Validation

• 5 focused resolver tests
• Ruff
• mypy
• git diff --check

Not included

• release containment
• local checkout resolution
• GitHub HTTP implementation

[danielporterda]

Closing this draft because the inline release-aware snippet stack is being retired. The branch remains available if its implementation is needed later.