fix(atlas): honour a project pin only when its dedupe key matches (#112)

resolveProjectId returned the local .openscience/project.json pin
unconditionally, ignoring the dedupe_key that writeProjectPin had stored
alongside it. When the pin is stale or belongs to a different identity —
the remote was re-pointed to a fork, a .openscience/ dir was copied in,
or the project was deleted — find-or-create returned the wrong/dead id
and never created the correct graph, surfacing as 'the graph won't load
/ shows the wrong project / stays empty'.

readProjectPin now returns the stored dedupe_key, and resolveProjectId
trusts the pin only when pinMatchesKey() holds (no key = legacy pin, kept
for back-compat; otherwise the key must equal the repo's freshly-computed
key). A mismatched pin falls through to resolve-or-create, which
overwrites it with the current key.