feat(tools/research): semantic finding deduplication (report-only, opt-in)

[VoidChecksum]

What

Adds a semantic finding deduplication layer to the research tools. It is additive, opt-in, and report-only — no existing flow changes behavior, and no nodes are deleted or mutated.

Why

The knowledge graph dedups writes only by deterministic node ID (SHA1(kind + canonical key) — see decepticon_core/types/kg.py and tools/research/neo4j_store.py). The multi-agent design (recon / exploit / analyst / vulnresearch, each running with fresh context) structurally produces separate nodes for the same underlying vulnerability when it is reached via a different route or described with different wording. Those near-duplicates survive ID-based dedup and surface as repeated entries in reports. Peers (Strix report/dedupe.py, RedAmon, CAI) ship an LLM-judge dedup layer; this adds a clean, pure, testable equivalent.

How

New module packages/decepticon/decepticon/tools/research/dedupe.py:

• find_duplicate(candidate, existing, judge) -> DuplicateVerdict — a pure function. The judge is an injected callable (a, b) -> dict, so tests stub it and no LLM client is imported in the module. A cheap deterministic pre-filter (same NodeKind + normalized host / endpoint / CWE overlap) runs before the judge, so non-candidates are rejected without invoking it. DuplicateVerdict is a small frozen dataclass (is_duplicate: bool, canonical_id: str | None, reason: str).
• kg_dedupe_findings @tool — walks Finding/Vulnerability nodes, groups likely-duplicates via the pre-filter (union-find over pairwise pre-filter hits), and returns a structured JSON summary of duplicate clusters. It is report-only: it never deletes or mutates nodes. It defaults to the deterministic pre-filter (no LLM wiring) to stay simple and green; a live judge is a clean follow-up via find_duplicate's injectable seam.
• Registered in RESEARCH_TOOLS exactly like the sibling kg_* tools.

Scope / isolation

• Does not touch reporting renderers or existing dedup/merge code.
• tools.py change is 2 lines (one import + one list entry).
• No package-lock.json / uv.lock changes.

Tests

packages/decepticon/tests/unit/research/test_dedupe.py (13 tests) builds fixture KnowledgeGraphs — two findings describing the same bug (same host + CWE, different wording) and two clearly-distinct findings — and, with a fake judge, asserts:

• the pre-filter pairs the same-host+CWE candidates and not the distinct ones (and skips the judge entirely for non-candidates, verified with an exploding judge);
• find_duplicate returns is_duplicate True/False correctly with the right canonical_id/reason;
• kg_dedupe_findings returns the expected cluster summary and does not mutate the graph.

No Docker / Neo4j / live-LLM.

Gate evidence

• ruff check — clean
• ruff format --check — clean
• basedpyright dedupe.py tools.py — 0 errors, 0 warnings, 0 notes
• pytest tests/unit/research tests/unit/tools/test_skills_registry.py — 264 passed (13 new; registry test confirms clean registration)