Resolve a GitHub owner/repo coordinate to an indexed source (read-only, no materialize)

Read-only counterpart to POST /v1/lookups: given coordinate=owner/repo (optionally github:owner/repo), returns the canonical org-scoped tuple { sourceId, sourceSlug, orgSlug } for a matching visible catalog source, or 404 when the repo isn't indexed. Unlike the POST, it never probes GitHub or materializes a hidden stub. Matches sources.url case-insensitively; on a multi-row case collision it prefers the exact-case row, then the oldest by (createdAt, id).