fix(cli): refuse ambiguous EVM network selection (devnet manifest vs mainnet default)

[Nic-dorman]

Summary

Fixes the silent-payment-failure trap around --evm-network and completes audit finding #5 (EVM resolution belongs in ant-core). Stacked on #155 (base branch refactor/v2-189-cli-thinning) — merge that first, then retarget/merge this; CI runs once this retargets to main.

The trap: --evm-network defaulted to arbitrum-one unconditionally, so --devnet-manifest with a custom EVM block but without --evm-network local silently paid against the hardcoded mainnet vault address on the manifest's chain. On Sepolia that address is an EOA: the tx "succeeds" as a no-op, gas is spent, the ANT allowance goes to a useless spender, and every subsequent chunk PUT fails median-payment verification — looking like a payment-protocol bug rather than a flag bug.

Changes:

• String→EvmNetwork resolution (including manifest evm-block parsing for local) moves to ant_core::config::resolve_evm_network with typed errors (EvmNetworkAmbiguous, UnsupportedEvmNetwork, EvmManifestRequired, InvalidEvmManifest), so every frontend shares one implementation. (EvmNetwork and DevnetManifest are foreign re-exports, so the resolver is a free function in ant_core::config next to resolve_bootstrap_peers rather than an inherent method.)
• No break for mainnet users: the default stays arbitrum-one — except when a devnet manifest carrying an evm block is loaded. That one combination (the only path where the trap fires) now errors and asks for an explicit choice: local to use the manifest's EVM config, or a preset to override it.
• Selecting a preset while the manifest carries an EVM block prints a warning that the manifest's EVM config is ignored (the one remaining discard path, now loud).
• ant-cli drops its direct reqwest dependency — the moved URL parse was the last use.

Testing

• 7 unit tests on resolve_evm_network (mainnet default with no manifest / manifest-without-evm, ambiguous error when manifest has an evm block, preset mapping, local happy path with URL/address round-trip, missing manifest/evm block, unknown name, bad manifest values); full workspace suite passes; clippy/fmt clean.
• CLI smoke: no flag + no manifest → mainnet address printed; no flag + manifest-with-evm → clear ambiguity error; preset + manifest-with-evm → warning on stderr, result on stdout; local + manifest → resolves; mainnet → unsupported error; local without manifest → manifest-required error.

🤖 Generated with Claude Code

[Nic-dorman]

Superseded by #158 (stacked on #157) — same branch-rename closure as #155.