Phase 3: embedding-based intent resolver (opt-in, backward-compatible)

[shreyanshjain7174]

Summary

Adds an opt-in embedding-based intent resolver (`--resolver embedding`) that generalizes beyond literal keyword matches. Pure Go, dependency-free, deterministic, offline-capable. Drop-in replacement behind the existing `Resolver` interface.

Why

The keyword resolver works perfectly for the S1-S5 benchmark scenarios (because those intents use literal keywords like 'query', 'email', 'slack'). But production agent intents are paraphrased. The embedding resolver covers the variation without sending intent text to an external API.

Side-by-side smoke

Live server, four paraphrased intents:

Intent	keyword	embedding
query the customer database	1 action	2 actions
pull last week revenue numbers	ERR no caps	1 action
drop a message in the channel	1 action	2 actions
deliver the report by email	2 actions	2 actions

How it works

1. Each capability has 4-6 training phrases (`DefaultExamples()`).
2. Hash each phrase token into 256 buckets, weight by IDF, average per-capability, L2-normalize -> centroid.
3. At query time vectorize the intent the same way; pick capabilities with cosine >= threshold (default 0.20).
4. Falls back to the keyword resolver when no centroid passes the threshold so adversarial intents still resolve.

Backward compatibility

`--resolver keyword` is the default. The S1-S5 benchmark numbers are unaffected. Embedding is opt-in.

Validation

• `go vet ./...`: clean.
• `go test -race ./...`: 9 packages green.
• internal/resolver coverage: 97.4% (was 100% before; embedding adds 2 small math helpers at 87.5/83.3%).
• staticcheck + govulncheck: clean.
• pytest --cov-fail-under=85: 65 passed, 96.91% coverage.
• 9 new resolver test cases (known phrases, paraphrase generalization, determinism over 50 iterations, hint passthrough, threshold fallback, error surfacing, empty input, defaults, malformed-example skipping).