Org name -> ID resolution has no exact-match verification against MarkMonitor's search semantics

[spbsoluble]

Deferred from #6 (review-findings-of-review-findings pass), flagged for triage before GA.

Where

MarkMonitorClient.ResolveOrganizationIdAsync (markmonitor-caplugin/Client/MarkMonitorClient.cs:494):

private async Task<string> ResolveOrganizationIdAsync(string orgNameOrId)
{
    if (Guid.TryParse(orgNameOrId, out _)) return orgNameOrId;
    var orgs = await ListOrganizationsAsync(0, 1, orgNameOrId);
    return orgs.FirstOrDefault()?.Id;
}

Same pattern in ResolveOrganizationAsync (markmonitor-caplugin/Client/MarkMonitorClient.cs:777).

Problem

When OrgId is configured as a friendly name rather than a GUID, this takes the first result
MarkMonitor's org search returns for that name and trusts it's the right one. It's unconfirmed
whether MarkMonitor's /certs/v1/organization search does an exact match on the name filter or a
substring/fuzzy match. If it's not exact, a configured org name that happens to be a prefix/substring
of another org's name in the same account could silently resolve to the wrong organization -
directly undermining the cross-org ownership checks added elsewhere in #6 (revoke, and the
recommended fix for cancel in #11), since those checks trust whatever ID this resolves to.

Suggested fix

Confirm MarkMonitor's actual search semantics (sandbox test: configure two orgs with one name a
substring of the other, and see what ListOrganizationsAsync(0, 1, name) returns for the shorter
one). If it's not exact-match, add an explicit case-insensitive equality filter over the results
before taking the first match, and fail/log clearly if none match exactly.