fix: warn and error on unmatched catalog IDs in Mobilize

[jmeridth]

Related privateerproj/privateer#214

What

Add warning logs for each requested catalog that doesn't match any available evaluation suite, return an error when no requested catalogs match at all, and clear Evaluation_Suites at the start of Mobilize() to ensure idempotent behavior on repeated calls.

Why

Mobilize() silently skipped unmatched catalog IDs, causing zero suites to execute with no indication of misconfiguration. This made it difficult to diagnose when a plugin's catalog IDs changed (e.g., osps-baseline → osps-baseline-2026-02) and downstream consumers hadn't updated their configs. This caused a silent integration test failure in privateerproj/privateer.

Notes

• Partial matches (some catalogs found, some not) log warnings but still succeed — this avoids breaking configs that intentionally list catalogs not supported by every plugin
• Total misses (zero suites executed) return a new NO_MATCHING_CATALOGS error that includes both the requested and available catalog IDs, making the fix obvious without inspecting plugin internals
• Evaluation_Suites is now cleared at the top of Mobilize() to prevent stale results from a prior call masking a zero-match on subsequent calls
• The warning includes the full list of available catalog IDs so the user can see valid options

Testing

• Added TestEvaluationOrchestrator_Mobilize_UnmatchedCatalogs with three subtests:
  • Error When No Requested Catalogs Match: verifies Mobilize returns NO_MATCHING_CATALOGS error when zero suites match
  • Repeated Calls Clear Prior Results: verifies a second Mobilize() with unmatched catalogs correctly errors instead of silently succeeding with stale results
  • Partial Match Succeeds With Warning: verifies Mobilize succeeds and executes the matching suite when at least one catalog matches
• Full test suite passes (go vet ./..., go test ./..., golangci-lint run ./...)