Resolve Cedar entities for a given resource, returning the full entity hierarchy that would be used in an authorization decision.

Follows the emit_authz pattern: event context is built upfront, and ALL fallible work runs inside a single async block whose Result is passed to emit_authz. Every failure — catalog errors, role-lookup failures, authorization denials — is audited.

Authorization gate: IntrospectAuthorization on the target resource, checked via the upstream require_*_action / load_and_authorize_* helpers (parallel fetches, TOCTOU-safe cache refresh, canonical error handling).