Group related resolve targets across CLI and MCP

[jlitola]

Summary

• consume the backend ordered resolve-target presentation list in exactly one GraphQL request
• group only contiguous equal non-null group keys while preserving order across CLI text, CLI JSON, and MCP
• keep every package, repository, and site target distinct while moving its metrics onto the identity line
• assign compact evidence lanes consistently: packages show downloads/license, repositories show stars/code, sites show docs, and packages retain projected fallbacks when a corresponding target kind is absent
• use one Related targets heading, render exact lowercase mit as MIT in text, and keep JSON lossless
• preserve ambiguity, confidence, protection, descriptions, repository identity, availability, truncation, and malicious-package actionability

Backend coordination: githits-com/pkgseer-backend#2141 is deployed to dev and production. This PR does not modify pkgseer-backend.

Validation

• bun test: 3520 passed, 0 failed
• focused resolve and smoke tests: 110 passed, 0 failed
• typecheck, lint, formatting, diff check, and build passed
• public-package and plugin asset validation passed
• built CLI and MCP smokes passed
• authenticated source CLI smoke passed all 90 steps, including live express and expressjs grouped resolve shapes and JSON parity
• authenticated source MCP smoke passed all 47 steps, including resolve_target text and JSON
• internal code review clean
• retained Claude Opus review clean after the compact UX and final evidence-plan cleanup, including a fresh-context full-delta check

Live resolve UX

• express groups npm:express, github:expressjs/express, and site:expressjs.com; metrics stay on their semantic target lanes
• expressjs directly matches site:expressjs.com and keeps the package and repository as relation-only members of the same group