feat: deduplicate DAST findings, PR comments, and pentest reports

Two-phase DAST dedup: exact fingerprint match (title+endpoint+method)
and CWE-based related finding merge (e.g., HSTS reported as both
security_header_missing and tls_misconfiguration). Applied at insertion
time in the pentest orchestrator and at report export.

PR review comments now include fingerprints and skip duplicates within
the same review run.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

compliance-agent/src/pipeline/pr_review.rs

@@ -1,5 +1,6 @@
 use compliance_core::models::*;
 
+use super::dedup::compute_fingerprint;
 use super::orchestrator::PipelineOrchestrator;
 use crate::error::AgentError;
 use crate::pipeline::code_review::CodeReviewScanner;
@@ -89,12 +90,37 @@ impl PipelineOrchestrator {
             return Ok(());
         }
 
+        // Dedup findings by fingerprint to avoid duplicate comments
+        let mut seen_fps = std::collections::HashSet::new();
+        let mut unique_findings: Vec<&Finding> = Vec::new();
+        for finding in &pr_findings {
+            let fp = compute_fingerprint(&[
+                repo_id,
+                &pr_number.to_string(),
+                finding.file_path.as_deref().unwrap_or(""),
+                &finding.line_number.unwrap_or(0).to_string(),
+                &finding.title,
+            ]);
+            if seen_fps.insert(fp) {
+                unique_findings.push(finding);
+            }
+        }
+
+        let pr_findings = unique_findings;
+
         // Build review comments from findings
         let mut review_comments = Vec::new();
         for finding in &pr_findings {
             if let (Some(path), Some(line)) = (&finding.file_path, finding.line_number) {
+                let fp = compute_fingerprint(&[
+                    repo_id,
+                    &pr_number.to_string(),
+                    path,
+                    &line.to_string(),
+                    &finding.title,
+                ]);
                 let comment_body = format!(
-                    "**[{}] {}**\n\n{}\n\n*Scanner: {} | {}*",
+                    "**[{}] {}**\n\n{}\n\n*Scanner: {} | {}*\n\n<!-- compliance-fp:{fp} -->",
                     finding.severity,
                     finding.title,
                     finding.description,
@@ -123,6 +149,17 @@ impl PipelineOrchestrator {
                 .join("\n"),
         );
 
+        if review_comments.is_empty() {
+            // All findings were on files/lines we can't comment on inline
+            if let Err(e) = tracker
+                .create_pr_review(owner, tracker_repo_name, pr_number, &summary, Vec::new())
+                .await
+            {
+                tracing::warn!("[{repo_id}] Failed to post PR review summary: {e}");
+            }
+            return Ok(());
+        }
+
         if let Err(e) = tracker
             .create_pr_review(
                 owner,