feat(users): add strict batch identity resolution

[dwaxe]

Closes #129.

Adds an opt-in agent-slack user resolve <identities...> command for fail-closed identity resolution.

• Matches IDs, emails, handles, and whitespace-bearing full names exactly across every users.list page.
• Verifies active-human eligibility, detects ambiguity and incomplete directory evidence, and restarts a full scan after credential refresh.
• Emits live Slack mentions only when every requested identity resolves uniquely; unsafe output contains no live mention tokens.
• Leaves the existing operational user and search resolvers unchanged.
• Keeps the README and installable agent skill aligned with the new safety contract.