sp dedup — content-hash duplicate detection (#28)

[rwrife]

Closes #28

Adds sp dedup: a content-equality hygiene primitive that hashes every live scratch (SHA-256), groups byte-identical copies into clusters, and reports the wasted footprint — naming the oldest copy in each cluster as canonical.

What changed

• internal/store/dedup.go — Dedup() (read-only clustering; skips unreadable content instead of crashing) and Collapse() (morgue-first, never hard-deletes; keeps the canonical member live).
• internal/render/dedup.go — tombstone-flavored human report + colorless/personality-free --json (stable contract: clean flag, non-nil arrays, full digest, collapsed null until a collapse runs).
• internal/cli/dedup.go — sp dedup with --json, --no-color, --collapse; wired into root.
• README documents the command and its morgue-first --collapse behavior.

Acceptance criteria

• Read-only exact-duplicate report (canonical = oldest; count + wasted bytes + total reclaimable); clean headline when unique.
• --json mode (arrays never null, no color/personality).
• --collapse moves redundant copies to the morgue, preserves canonical, never hard-deletes.
• Default strictly read-only; --collapse explicit and reports what it moved.
• Edge cases: empty store, single scratch, unreadable/missing content (skipped), identical bytes with different names/tags.
• Tests (store grouping/canonical/wasted-byte/collapse + read-only guarantee, render/JSON shape, CLI end-to-end). go build/go vet/go test ./.../gofmt clean.
• README updated.

Note: pin-awareness is scoped out (no sp pin exists yet); canonical selection is oldest-first, ready to prefer a pinned member when pinning lands.