fix(audit): enforce dual Zed and submodule ownership

[ORESoftware]

Summary

• makes the merged fleet auditor enforce the ownership rule already documented by feat(audit): enforce the Zed repository-family contract #12
• normalizes relative, HTTPS, and SCP-style GitHub submodule URLs
• reads each submodule repository's actual .zpkg.toml package identity
• reports an error when that coordinate also appears in the monorepo's Zed dependency graph
• preserves the existing CLI/infra rejections and read-only audit model

Why

The original fleet-auditor PR described dual Zed/submodule ownership detection, but its implementation only rejected CLI and infrastructure submodules. This focused follow-up makes the executable audit match the merged contract instead of weakening the documentation.

[linear-code]

DEN-2327