[Findings] Proper dedupe of AI + local-rule findings (C2)

[AndresL230]

Summary

Findings from remote (AI review) and local-rule (waste detector) that describe the same issue at the same location should dedupe to one finding, preferring the higher-confidence source.

Why

The two sources phrase the same issue differently. The current dedupe key in makeFindingDedupeKey includes the description text — so they don't collapse. Users see two findings for the same call.

Current state

src/intelligence/finding-dedupe.ts has two strategies:

• makeFindingDedupeKey — includes description text. Used by default.
• makeFindingContextDedupeKey — buckets by line + provider + method + library + originFile + originFunction. Better, but unclear if used at the AI/local merge point.

What to do

1. Find the AI/local-rule merge point (likely in webview-provider.ts).
2. Replace with a structural key:

function findingMergeKey(f: FindingNode): string {
  return [f.filePath, f.type, f.endpointId ?? "no-endpoint",
          f.lineRange ?? lineFromSpan(f.span)].join("::");
}

3. When duplicates collapse: preserve the higher-confidence finding, append the other's source as metadata.
4. Confidence of merged finding = max() of inputs.
5. Description = prefer AI's (richer), fall back to local-rule.

Acceptance criteria

• Two findings of same type on same endpointId collapse to one
• Collapsed finding lists both sources (sources: ["local-rule", "remote"])
• Confidence is max(), not averaged
• UI shows "detected by 2 sources" when applicable

Depends on

• B3 (stable endpoint IDs)

Reference

Full design: https://github.com/recost-dev/extension/blob/main/docs/accuracy/findings.md#c2-proper-dedupe-of-ai--local-rule-findings