fix: dedupe prompt findings by content hash

[luohui1]

Summary

• add prompt-content dedupe for duplicate prompt_injection findings on prompt and instruction surfaces
• keep the first finding while recording every source location in also_found_in
• add regression coverage for duplicate content across files and distinct prompts in the same file

Fixes #205

Type of change

• Bug fix
• New feature / analyzer
• Breaking change
• Documentation

Test plan

• uv run pytest tests\test_prompt_dedupe.py tests\test_instruction_discovery.py tests\test_tpa_patterns.py tests\test_surface_scan_artifacts.py tests\scoring\test_analyzer_evidence.py
• uv run ruff check src tests
• git diff --check

Checklist

• CHANGELOG.md updated (if user-facing) — see Keep a Changelog
• Tests added or updated
• No secrets or credentials in code
• Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)