Connectors page lists an ambient gatekeeper that also advertises resources twice under "Available"

## Description

We run a custom gatekeeper Worker (built per the custom-gatekeeper recipe) whose vendor both auto-provisions its account (`VendorDescription.autoProvisionsAccount: true` — it holds a deployment credential, so there is no OAuth flow to run) and advertises a resource pattern via `getSupportedResources()` (so blueprints can bind it).

On the Connectors page, this vendor's card appears **twice** in the "Available" section until the user adds the account, after which it collapses to a single card. Both cards open the same modal and behave identically, so this is cosmetic — but it reads as a broken deploy.

Observed on our pinned build (`6478a144`) and the composition looks unchanged on current `main`.

## Steps observed

1. Deploy a custom gatekeeper whose vendor sets `autoProvisionsAccount: true` **and** returns a non-empty `getSupportedResources()`.
2. Bind it to the workshop as `GATEKEEPER_`; leave its ambient mode at the default ("optional") and do not add an account yet.
3. Open the Connectors page: the vendor renders twice under "Available".
4. Add the account via either card: it moves to "Connected" and the duplicate disappears.

## Expected behavior

One card per vendor in "Available".

## Where it appears to come from

`workshop-frontend/src/routes/gatekeepers.tsx` composes the section as `availableVendors = [...vendors, ...addable]` — the outputs of `listGatekeeperVendors()` (vendors with ≥1 enabled resource) and `listAddableGatekeepers()` (ambient vendors in "optional" mode with no account yet) — without de-duplicating by vendor id. `listAddableGatekeepers()`'s comment assumes the sets are disjoint ("ambient gatekeepers expose no resources"), which a vendor like ours breaks: auto-provisioned *and* resource-advertising.

If a dedup by id in the memo (keeping the resource-bearing entry) is the direction you'd want, we're happy to send that as a small PR per CONTRIBUTING.md — otherwise this is just the report.

Start in workshop-frontend/src/routes/gatekeepers.tsx and trace how listGatekeeperVendors() and listAddableGatekeepers() are combined into availableVendors. Reproduce the case with an auto-provisioned, resource-advertising custom gatekeeper, then verify that the Connectors page shows one Available card before an account is added and still moves it to Connected afterward.

Written by the indexing model from the issue text.