Detect canonical-rule duplication risks

## Problem
The same normative rule gets copied into multiple policy/instruction files and then drifts. No real detector exists today — the repository's one existing duplication-adjacent check (`scripts/skill_metadata/_support.py::check_absent`) only flags a Skill restating a section it doesn't own, against a fixed phrase list; it does not scan for near-duplicate normative text across sources.

## Goal
A heuristic check that flags likely duplicated canonical-rule blocks across policy and instruction sources.

## Scope
- Identify near-duplicate normative blocks across policies and instructions.
- Report candidates with file and span.
- Keep it advisory unless a strict allowlist is exceeded.

## Non-goals
- Auto-deleting or auto-editing duplicated text.

## Acceptance criteria
- Check reports near-duplicate normative blocks.
- Output is actionable (file plus span).
- Known-acceptable near-duplicates can be allowlisted.

## Dependencies
Parent: #46 (open).

## Validation
- A seeded duplicated block is flagged.
- An allowlisted known duplicate is suppressed.