Add stable finding fingerprints and semantic clustering

## Problem

OpenCodeReview findings do not have stable semantic identity. Downstream workflows can suppress exact copies by path, line range, and body, but they cannot reliably recognize:

- the same invariant rephrased by different subtasks;
- one root cause reported against multiple nearby locations;
- an unchanged finding across reruns or providers;
- a finding that should update or resolve an existing review thread.

In a matched six-PR cohort, OCR emitted 85 findings that normalized to 74 claims: 11 duplicate units (12.9%). Only one was an exact-body duplicate; ten were semantic duplicates. In a same-commit provider comparison, duplicate rates were 16.4% and 6.5%. Exact text filtering therefore addresses only a small part of the observed problem.

PR 337 provides line-range incremental suppression, and session persistence has file/diff fingerprints. Those are useful but materially different from finding identity.

## Desired behavior

Provide versioned stable finding fingerprints and semantic clustering before result publication.

## Acceptance criteria

- Each finding has a deterministic fingerprint based on reviewed input identity, normalized claim/invariant, path, and symbol.
- Formatting-only prose changes do not change the fingerprint.
- Identical prose about different symbols or invariants remains distinct.
- Exact duplicates are removed before output.
- Semantically related findings expose a cluster ID, representative finding, member IDs, confidence, and clustering reason; members are not silently discarded.
- Cross-file reports of one root cause are represented explicitly rather than accidentally collapsed.
- Fingerprint and cluster fields are included in JSON and persisted session output.
- Tests cover exact copies, rephrases, same text/different symbols, one root cause across paths, provider reruns, and false-positive separation.
- Downstream consumers can suppress unchanged fingerprints and update or resolve one existing review thread.

## Non-goals

- Do not require a particular embedding provider.
- Do not rely on one unexplained global similarity threshold.
- Do not automatically dismiss a finding merely because another review system reports a related concern.

## Related work

- PR 337: incremental line-range suppression
- PR 306: resumable sessions and file-level fingerprints

This issue is specifically about finding-level identity and semantic output deduplication.