unic-spec-review S8: dedup + Approval Loop — content-similarity dedup-matcher + cancellable loop with post-none exit

[orioltf]

Parent

Epic: #200 — unic-spec-review plugin.

What to build

Close the posting path with de-duplication and a fully cancellable Approval Loop, so posting is deliberate, multi-user safe, and never silently piles up duplicates.

• dedup-matcher: compares a candidate Finding against all existing comments on the page — the reviewer's own prior runs, other reviewers' runs of this command, and human comments — by content similarity (no hidden marker, no local state file; it reads the shared page, so it is multi-user and multi-run safe). Returns near-duplicate candidates plus a post / skip / flag-for-tiebreak decision.
• Approval Loop: with --post, present the ranked Findings, each annotated with its near-duplicate flag. The reviewer selects which to post. Borderline (flagged) matches are surfaced for a human tiebreak so the non-deterministic similarity check never silently drops or re-raises a Finding. The loop is cancellable at every step, including a final "post none" exit after selecting. Selection is not commitment.

Confirmed, non-duplicate (or tiebreak-approved) Findings are posted via the S7 write path with their anchors and attribution footers.

Acceptance criteria

• dedup-matcher compares a candidate Finding against all existing comments (own prior runs, other users' runs, human comments) and returns near-duplicate candidates + a post/skip/flag-for-tiebreak decision; no hidden marker, no local state file.
• The Approval Loop shows ranked Findings with near-duplicate flags; the reviewer selects which to post.
• Borderline matches are surfaced for an explicit human tiebreak; neither dropped nor re-raised silently.
• The loop is cancellable at every step, including a final "post none" exit after selection. Bare runs remain read-only.
• node:test unit tests cover dedup-matcher (similarity + decision logic) with injected comment sets; no live services. The Approval Loop driver is not unit-tested.
• PR adds CHANGELOG.md bullets under [Unreleased] and bumps the patch version; verify:changelog passes. No em dash in authored text (except the mandated CHANGELOG version header).

Blocked by

• unic-spec-review S7: posting (--post write path) — comment write, inline-anchor-resolver, attribution footer #206 (S7 — comment write path, anchors, attribution footer).
• unic-spec-review S3: shared context — read existing comments + Landscape Brief #204 (S3 — existing-comment read that dedup compares against).