Add stable finding fingerprints and semantic clustering

[acoliver]

Problem

OpenCodeReview findings do not have stable semantic identity. Downstream workflows can suppress exact copies by path, line range, and body, but they cannot reliably recognize:

• the same invariant rephrased by different subtasks;
• one root cause reported against multiple nearby locations;
• an unchanged finding across reruns or providers;
• a finding that should update or resolve an existing review thread.

In a matched six-PR cohort, OCR emitted 85 findings that normalized to 74 claims: 11 duplicate units (12.9%). Only one was an exact-body duplicate; ten were semantic duplicates. In a same-commit provider comparison, duplicate rates were 16.4% and 6.5%. Exact text filtering therefore addresses only a small part of the observed problem.

PR 337 provides line-range incremental suppression, and session persistence has file/diff fingerprints. Those are useful but materially different from finding identity.

Desired behavior

Provide versioned stable finding fingerprints and semantic clustering before result publication.

Acceptance criteria

• Each finding has a deterministic fingerprint based on reviewed input identity, normalized claim/invariant, path, and symbol.
• Formatting-only prose changes do not change the fingerprint.
• Identical prose about different symbols or invariants remains distinct.
• Exact duplicates are removed before output.
• Semantically related findings expose a cluster ID, representative finding, member IDs, confidence, and clustering reason; members are not silently discarded.
• Cross-file reports of one root cause are represented explicitly rather than accidentally collapsed.
• Fingerprint and cluster fields are included in JSON and persisted session output.
• Tests cover exact copies, rephrases, same text/different symbols, one root cause across paths, provider reruns, and false-positive separation.
• Downstream consumers can suppress unchanged fingerprints and update or resolve one existing review thread.

Non-goals

• Do not require a particular embedding provider.
• Do not rely on one unexplained global similarity threshold.
• Do not automatically dismiss a finding merely because another review system reports a related concern.

Related work

• PR 337: incremental line-range suppression
• PR 306: resumable sessions and file-level fingerprints

This issue is specifically about finding-level identity and semantic output deduplication.