v5: make get package targeting exact and consistent before freezing the CLI #1280

Before v5 ships, get <name> must select the exact requested package consistently with scan --package, and must consider every installed version of that package.

Current main at 40de3d51fa8a07d75914f2021f75ef97cd3f64e2 still calls fuzzy_match_packages and selects only matches[0] in commands/get.rs. That can choose a similarly named package or miss the vulnerable nested version. Hosted/vendored get can then act without an interactive confirmation. This is a normal command-selection problem, independent of crashes, parallel processes, or repeated-run stress tests.

PR #1034 already implements the shared target grammar and has regression evidence for the wrong-name/nested-version cases. It is still open. #453 tracks the UUID policy-warning part of that PR; this issue tracks the broader public targeting contract so it is not lost behind that narrower title.

Release acceptance:

• get yaml never silently selects yaml-ast-parser when yaml is absent; near matches may be suggestions.
• An exact package name queries all matching installed versions, including a vulnerable nested version.
• --ecosystems scopes both UUID and search forms before any write.
• get, remove, rollback, and the UUID shortcut have documented, consistent target parsing; ambiguous names are refused with an actionable exact spelling.
• The migration guide describes the intentional change from fuzzy selection and any changed target/error behavior.
• Land Use one package target grammar for get, remove, rollback and the UUID shortcut #1034 or an equivalent focused fix before the v5 release PR chore(release): 5.0.0 #1194. No wholesale command renaming is required.

Filed during the maintainer-requested v5 issue triage. The release priority is the single-instance, valid-lockfile patch/install workflow and a stable, understandable public interface.