Fail clearly on unresolved shiv minor pins

[quick-ricon]

Summary

• fail clearly when a raw numeric partial shiv version such as 0.1 cannot be resolved to a concrete release tag
• stop falling through to delegated installs like sms@v0.1 after tag lookup failure or no matching patch tag
• add Lua regression coverage for both no-match and tag-fetch-failure cases

Context

NVR's Fly remote builder hit this failure while installing shiv:sms = "0.1" during a fresh Docker build:

shiv install failed for sms@v0.1: Error: ref 'v0.1' not found in KnickKnackLabs/sms

Minor-stream pins are valid and work locally. The misleading v0.1 came from vfox-shiv's install-time fallback path: when mise passes the raw minor version through to BackendInstall, vfox-shiv tries to resolve matching tags. If that lookup returns no versions, it currently returns the original partial version and then prefixes it with v.

This PR keeps the existing successful path (0.1 -> latest matching 0.1.x) and changes the failure path to stop in vfox-shiv with an explicit resolution error.

Validation

• lua test/lua/run.lua "$PWD"
• mise run test latest_refresh
• mise run test
• git diff --check
• git pre-push after push: OK except expected “no local commits to push” warning

[ikma-ricon]

Approved. The failure policy is right: once BackendInstall is handed a partial numeric selector, delegating a fabricated v ref to shiv only obscures the resolver failure. Successful minor-stream fallback remains covered, and the new unit coverage hits both real failure modes in this path: tag lookup failure and fetched tags with no matching patch.\n\nI re-ran locally: mise exec -- lua test/lua/run.lua "/home/runner/agents/ikma/vfox-shiv", mise run test, and git diff --check origin/main...HEAD.