Resolve stage: matching, version resolution, fixtures; BGG API auth

bggpipe resolve works end to end: search -> exact/fuzzy candidate
scoring -> auto/ambiguous/unmatched classification with owned-count
tie-breaks (mixed base/expansion candidates never auto-match), version
scoring from edition cues (never guessed; no cues -> version_unknown),
idempotent matches.csv appends.

Discovered mid-build: BGG now requires registered-application Bearer
tokens on the XML API (2025 policy change) and returns 401 otherwise.
Client sends Authorization from BGG_API_TOKEN and raises an actionable
BGGAuthError; CLAUDE.md and the bgg-api skill are updated to match.
Live fixture recording is blocked until registration is approved, so
tests replay hand-crafted stub fixtures via a network-refusing
transport; scripts/record_fixtures.py re-records real XML under the
same cache keys once a token exists. One live read-only smoke test is
skipped unless --run-live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/fixtures/bgg_cache/thing_id=478-2C205398-stats=1_9bd49e518b.xml

@@ -0,0 +1,14 @@
+<items>
+  <item type="boardgame" id="478">
+    <name type="primary" value="Citadels"/><yearpublished value="2000"/>
+    <statistics><ratings><owned value="85000"/>
+      <ranks><rank type="subtype" id="1" name="boardgame" value="250"/></ranks>
+    </ratings></statistics>
+  </item>
+  <item type="boardgame" id="205398">
+    <name type="primary" value="Citadels"/><yearpublished value="2016"/>
+    <statistics><ratings><owned value="24000"/>
+      <ranks><rank type="subtype" id="1" name="boardgame" value="400"/></ranks>
+    </ratings></statistics>
+  </item>
+</items>