#3224 swamp access check run locally ignores the named resource's stored type and tags

Run locally (no --server), swamp access check builds the resource only from the --on string and any --field flags (src/cli/commands/access_check.ts:222). It never looks up the named model or workflow. So a grant that matches on the stored type or tags is ignored: with deny write --on model:command/shell, checking write on a command/shell model named team-x-probe reports ALLOW, while serve and access check --server report DENY.

Serve's own check resolves the named model through explainedResource (src/serve/handlers/access_handlers.ts:1372, swamp-club#2675). The local check should resolve a concrete model or workflow name from the repo the same way.

No security impact: serve enforces correctly, and only the advisory local check is wrong. Found while triaging swamp-club#3215.

Reproduction:

swamp repo init --tool none
swamp model create command/shell team-x-probe
swamp access grant create --subject user:alice --allow write --on "model:team-x-*"
swamp access grant create --subject user:alice --deny write --on "model:command/shell"
swamp access check --subject user:alice --action write --on model:team-x-probe

Expected DENY (what serve returns), actual ALLOW.