[M5+] resolve_version + cmd_add lockfile pin

CHANGELOG.md

@@ -91,6 +91,18 @@ All notable changes to cargoxx will be documented in this file.
   6 cases against fixtures derived from a real fmt 10.2.1 response;
   `tests/devbox_resolve_live.cpp` (gated by `CARGOXX_NETWORK_TESTS=1`)
   hits the live API.
+- `cargoxx.resolver::resolve_version(name, version)` orchestrator
+  chains `devbox_resolve` (HTTP, primary) → `nixpkgs_git_resolve`
+  (offline, fallback). Returns a 40-char nixpkgs SHA. Wildcards
+  (`*`, empty) are rejected with `ResolutionVersionNotFound` since
+  they aren't concrete pins.
+- `cargoxx add <pkg>@<version>` now resolves the pin to a nixpkgs
+  rev *before* writing the manifest. Failure to resolve aborts the
+  add cleanly (no manifest mutation, no lockfile mutation). On
+  success the rev is persisted into `Cargoxx.lock`'s `nixpkgs_rev`
+  for that dep. Wildcards (`cargoxx add fmt`) skip resolution and
+  track `nixos-unstable` as before. Tests opt out of the network
+  resolver via `CARGOXX_NO_AUTORESOLVE=1`.
 - `cargoxx.resolver::nixpkgs_git_resolve(name, version, repo_path?)` —
   fallback for when search.devbox.sh is unreachable. Lazily clones
   `https://github.com/NixOS/nixpkgs.git` into