guard: rewrite resolveToDid to resolveIdentity

returns an identity instead, this can be passed along as env vars to
hooks.

Signed-off-by: oppiliappan <[e-mail]>

guard/guard.go

···
 	"os/exec"
 	"strings"
 
+	"github.com/bluesky-social/indigo/atproto/identity"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/urfave/cli/v3"
 	"tangled.sh/tangled.sh/core/appview/idresolver"
···
 	}
 
 	didOrHandle := components[0]
-	did := resolveToDid(ctx, l, didOrHandle)
+	identity := resolveIdentity(ctx, l, didOrHandle)
+	did := identity.DID.String()
 	repoName := components[1]
 	qualifiedRepoName, _ := securejoin.SecureJoin(did, repoName)
 
···
 	return nil
 }
 
-func resolveToDid(ctx context.Context, l *slog.Logger, didOrHandle string) string {
+func resolveIdentity(ctx context.Context, l *slog.Logger, didOrHandle string) *identity.Identity {
 	resolver := idresolver.DefaultResolver()
 	ident, err := resolver.ResolveIdent(ctx, didOrHandle)
 	if err != nil {
···
 		fmt.Fprintf(os.Stderr, "error resolving handle: %v\n", err)
 		os.Exit(1)
 	}
-
-	// did:plc:foobarbaz/repo
-	return ident.DID.String()
+	if ident.Handle.IsInvalidHandle() {
+		l.Error("Error resolving handle", "invalid handle", didOrHandle)
+		fmt.Fprintf(os.Stderr, "error resolving handle: invalid handle\n")
+		os.Exit(1)
+	}
+	return ident
 }
 
 func isPushPermitted(l *slog.Logger, user, qualifiedRepoName, endpoint string) bool {