Fix Worldspine Wurm duplicate triggers - #7526

Analyzed 4 changed files across four categories:

1. CI/CD — No GitHub Actions workflow files or CI configurations modified.
2. Lifecycle — No build hooks, package-manager scripts, Dockerfiles, or startup entrypoints modified.
3. Malicious intent / general changes — All changes are localized to the Phase engine's trigger-deduplication logic and accompanying regression tests for a known MTG rules bug (duplicate Worldspine Wurm triggers). No evidence of secret exfiltration, obfuscation, encoded payloads, network calls, dependency confusion, typosquatting, privilege escalation, credential handling, dangerous eval/exec, or reviewer-hiding patterns.
4. Skill mutations — No materialized skill target directories present; nothing to scan.

The compressed test fixture (integration_cards.json.gz) is explicitly documented by the author as adding a single card entry for the new observer assertion; it is a standard compressed JSON card-database fixture used by the existing test harness.