[M5+] resolve_version + cmd_add lockfile pin

src/resolver/resolver.cppm

@@ -174,4 +174,15 @@ auto nixpkgs_git_resolve(const std::string& name, const std::string& version,
                          std::optional<std::filesystem::path> repo_path = std::nullopt)
     -> util::Result<std::string>;
 
+// Top-level orchestrator: try `devbox_resolve` first, then
+// `nixpkgs_git_resolve` as fallback. Returns a 40-char nixpkgs SHA, or
+// `ResolutionVersionNotFound` when both probes come back empty.
+//
+// Use this from `cargoxx add <pkg>@<concrete-ver>` to capture the rev
+// that lockfile/codegen will pin. Wildcards (`*`, empty) should NOT be
+// passed — they are not concrete versions and the resolver returns
+// `ResolutionVersionNotFound` for them by design.
+auto resolve_version(const std::string& name, const std::string& version)
+    -> util::Result<std::string>;
+
 } // namespace cargoxx::resolver