fix(control-plane): close resolver findings + drop redundant ireturn nolints

Address trail #641 review findings on resolveref.go:

• case-insensitive name matching (EqualFold) in pickOrg, pickProject, and filterProjectsByName, matching the server's lower(name) uniqueness, so a case-only typo resolves instead of erroring
• guard empty resolved AccountId in resolveAccountRef with a clear local error instead of forwarding "" as the owner ULID
• add resolver tests asserting ULID refs make 0 HTTP calls and name/handle refs make exactly 1, plus case-insensitive and empty-account cases

Also drop three //nolint:ireturn directives: main's ireturn allowlist now covers checkpoint.CommittedStore/TemporaryStore, so they are redundant and CI's nolintlint fails on them as unused.