fix: preserve finding classification during deduplication - #462

Summary

• include classification and evidence in finding compaction identity
• apply the same classification identity in raw, normalized, declared-marker, and continuity scan views so unsafe matches cannot be discarded before reporting
• retain safe and unsafe matches that share a rule fingerprint as separate logical findings
• canonicalize evidence into a bounded digest and fail closed for unsupported plugin metadata
• preserve tag set semantics and highest-confidence compaction across location-specific context/snippets
• add analyzer-to-report regressions for same-line, cross-file, JSON, SARIF, and normalized-obfuscation cases

Root cause

Deduplication grouped findings only by source scope, rule ID, and match fingerprint. Occurrence expansion then copied the selected representative's classification metadata to every grouped location. PE3 findings for a safe read-only /etc/passwd mount and unsafe access could therefore inherit whichever classification won representative selection.

The same incomplete identity was also used earlier in static view deduplication, where it could discard the unsafe finding before report compaction ever saw it. This was order-sensitive and also affected normalized security views.

The fix shares a classification-aware identity across both layers. View-origin tags are ignored only when comparing equivalent projections; meaningful classification and evidence remain distinct. Confidence and location-specific context stay outside the identity, preserving established compaction and highest-confidence selection. Ambiguous evidence never merges and cannot abort terminal/Markdown scans.

Validation

• 339 focused deduplication, report, and pattern tests passed on the final local head
• 592 large-file, continuity, normalized-view, and reconstruction regressions passed during final review
• adversarial CLI scan retains both benign-mount and unsafe-access PE3 rows on the same line
• Ruff lint/format and git diff --check passed