Resolve substitutes {key} placeholders in tmpl from vars. If tmpl references
any key that is missing or empty, Resolve returns "" — callers treat that as
"no link", so partially-configured runs degrade cleanly. tmpl with no
placeholders is returned verbatim.