fix(gh-wrapper): resolve the owner from orgs/ and users/ api endpoints

[twistedmelonman]

What

_gh_wrapper_resolve_owner took a gh api call's owner only from repos/OWNER/.... It now also reads orgs/OWNER/... and users/OWNER/... (leading slash optional, {owner} placeholder ignored, first matching argument wins, ^ anchor kept so flag values like -f q=orgs/Z do not match). Every other path is unchanged.

Before: gh api orgs/nightowlstudiollc/repos from a non-NOS checkout used the cwd owner's token and returned public repos only (HTTP 200, no error), so fleet surveys under-counted silently.

Callers of the resolved owner

• Identity and token selection (_gh_wrapper_sync_identity): orgs/X and users/X now pick GH_TOKEN_<X's var>, the same as repos/X. An owner outside the three known ones keeps GH_TOKEN as given. This is the intended fix.
• Off-org draft guard (_gh_wrapper_block_off_org_promotion, _gh_wrapper_force_draft_for_off_org): the gh api check fires only for a POST to a pulls endpoint, which neither orgs/ nor users/ shapes. A gh api orgs/X/... call cannot trigger it. Read from the code, not exercised with a new test; the existing off-org guard test still passes.
• "No owner resolved" stop line: now fires less often, since these endpoints resolve.

Tests

bash/tests/test-gh-wrapper-token-select.sh (both standalone and function modes) gains: orgs/X, /orgs/X, users/X, /users/X select X's token; orgs/{owner} and users/{owner} fall back to cwd; -f q=orgs/Z does not match; the first matching endpoint wins. Existing repos/X/Y cases cover the unchanged path.

• Against the origin/main wrapper (scratch copy): 8 FAIL (the four X endpoints, both modes).
• With the fix: 45 PASS, 0 FAIL.
• Also run and passing: identity, off-org-guards, gh-token-precedence tests. The full suite runs in CI as bash-tests.

Closes #396