…n for clustering, dedup, and corroboration (#4919)

Story identity previously had three inconsistent answers: _clustering.mjs
(title-token Jaccard >= 0.5), news/v1/dedup.mjs (word-overlap > 0.6), and
list-feed-digest.ts story tracking (EXACT sha256 of the normalized title
— any wording edit forked the story, so corroboration only counted
verbatim wire syndication, deflating importanceScore's corroboration
signal and the BREAKING/DEVELOPING phase tracker).

New shared/story-identity.js (+ scripts/shared mirror, d.ts): dual-view
feature-hashed lexical vectors — a uniform-weight view and an
entity/number-boosted view; similarity = min of the two cosines, so a
pair merges only when both views agree. Each view catches the failure
mode the other is blind to (action swaps vs one-entity swaps). Threshold
0.615 tuned on a labeled pair set committed as the test-suite ground
truth (min positive 0.634, max negative 0.595); known limits (one-token
swaps, cross-language paraphrase) documented, with a
setStoryVectorProvider seam for a future semantic embedding upgrade.

All three call sites now delegate:
- _clustering.mjs drops its local Jaccard matcher (insights clustering)
- dedup.mjs reimplements deduplicateHeadlines on shared vectors and adds
  assignStoryIdentity (cluster batch -> canonical titleHash + cluster-wide
  corroboration count; canonical = hash of lexicographic-min normalized
  member title, so singleton clusters keep their exact pre-change keys)
- list-feed-digest.ts corroboration pass uses assignStoryIdentity;
  cluster members share one story:track identity and a real multi-wording
  source count

Closes #4919

🤖 Generated with Claude Code
Claude-Session: https://claude.ai/code/session_01WmhkGjZrb9RbV7pV3muFxP

…union-find clustering, suffix-blind vectors, per-hash tracking writes (#4924 review round)

Applies the multi-agent + cross-model review findings on PR #4924:

- canonical id anchors on the EARLIEST-published member (reliability P1,
  conf 100, corroborated by the story:track 3-incident history): a
  later-joining wording can no longer steal the identity mid-lifecycle
  and reset mentionCount/firstSeen/phase
- clusterTexts uses union-find connected components instead of greedy
  first-seed assignment (cross-model finding): cluster membership — and
  therefore the persistent identity — is now input-order independent
- source-attribution suffixes are stripped before vectorization
  (cross-model P1): Google-News wrapper titles carry "- Publisher" on
  every item, and the entity-boosted publisher token pulled DISTINCT
  same-wrapper stories toward a false merge
- containment rescue (>=90% token containment, min 4 tokens) restores
  the old dedup metric's guarantee for severely truncated headlines
  (testing P1, proven regression)
- writeStoryTracking runs mutable per-story writes (mentionCount
  HINCRBY, representative HSET) once per unique hash per cycle with a
  deterministic representative — per-member writes would inflate
  mentionCount by N per cycle and skip the DEVELOPING phase
  (reliability P2 + correctness, promoted on agreement)
- emoji/punctuation-only titles get per-item sentinel identities
  instead of pooling into one sha256("") phantom track (adversarial +
  testing, conf 100)
- hot-token candidate buckets capped at 250 (adversarial perf cascade);
  identity input clamped to 300 chars (unbounded-title n-gram bomb)
- clusterItems delegates to clusterTexts (maintainability P1) — the
  clustering ALGORITHM is now shared too, not just the similarity
- corroboration_count proto doc describes the edit-tolerant semantics;
  OpenAPI specs regenerated via make generate
- coverage-miss fallback logs instead of degrading silently;
  _clustering.mjs added to the mirror-import guard list

New regression tests: canonical stability across sequential builds,
order-permutation invariance, truncation + suffix labeled pairs,
degenerate-title sentinels, once-per-hash tracking (source-textual),
integration wiring assertions. 30/30 in story-identity suite; full
affected battery + both typechecks green.

Claude-Session: https://claude.ai/code/session_01WmhkGjZrb9RbV7pV3muFxP

… hot-bucket caps (#4924 external review)

251 verbatim syndications previously made every shared token bucket
exceed MAX_CANDIDATE_BUCKET, so no pairs were scored and the day's
most-corroborated story degraded to singletons. Identical normalized
texts now union unconditionally before the candidate scan.

Claude-Session: https://claude.ai/code/session_01WmhkGjZrb9RbV7pV3muFxP

… external review)

P1 — non-canonical variants lost cross-cycle continuity, WORSE than the
old exact hashing for that sub-case: cycle 1 (A+B, A canonical) wrote
only A's track; a cycle-2 B-only batch hashed to B and reset the story
to BREAKING/mentionCount=1. Now every cycle persists
memberHash -> canonicalHash alias rows (story:alias:v1, story-track
TTL) and the digest adopts the live canonical most members point at
(deterministic: most-common target, ties lexicographic) before
assigning hashes — one batched GET pipeline; failures degrade to
batch-derived canonicals. Two-cycle A+B -> B-only regression at the
pure level plus wiring pins.

P2 — EXPIRE for story:sources/story:peak was queued in the
once-per-hash PRE-block, before the per-member SADD/ZADD that CREATE
those keys: EXPIRE on a missing key is a no-op, so every brand-new
story leaked two persistent keys. The EXPIREs now ride adjacent to the
creating writes (idempotent per member); ordering pinned by test.

P2 hot-bucket identical-title clustering was already fixed this round
(exact-duplicate pre-union, ca80a2c). Pre-existing read/write prefix
parity filed as #4936.

story-identity 34/34, server-handlers 24, mirror 12, persistence 17,
typecheck:api clean.

Claude-Session: https://claude.ai/code/session_01WmhkGjZrb9RbV7pV3muFxP