feat(model): one defect is one finding, however many regions reach it

contributor-scan 2.9. Task 2.4 let a region's question follow the call
graph, and the moment it did, many entry points could reach one shared
sink: libpng reported the same site twenty-six times. A contributor shown
the same defect twenty-six times learns to scroll past it.

Findings are deduplicated on (site, family), keeping the strongest rung
and counting the regions that reached it -- "reached from 26 regions" is
the useful half of that observation and one row is the readable half. Two
families at one site stay two findings, because `echo $_GET[...]` is an
injection question and an output-encoding question with different answers.

The duplication that motivated this was removed by another route: the 26
rows were all the `fgets`-matched-as-`gets` false positive, and the sink
matcher fix took them out. So this changes no current number and is a
structural guarantee rather than a measured reduction -- the mechanism that
produced them is untouched, and only the finding that made it visible is
gone.

+25 lines for a guarantee, in a session that has been asked to watch its
growth. The audit is unchanged at 97 modules, 90 load-bearing and 7
standalone, with no orphans.

Gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

.kiro/specs/contributor-scan/tasks.md

@@ -185,7 +185,7 @@
   - _Requirements: 8.1, 8.2_
   - _Depends: 2.6_
 
-- [ ] 2.9 One defect is one finding, however many regions reach it
+- [x] 2.9 One defect is one finding, however many regions reach it
   - libpng's scan produced 26 entailed findings that are all the identical site,
     `contrib/gregbook/wpng.c:335:main`. Many regions reach one shared sink and each emits its own finding;
     nothing dedupes by site. A contributor would be shown the same defect twenty-six times.