bug: locate() maps every repeated config key to the first occurrence, so suppression and baseline fingerprints collapse (structural pass, #35) #165

What: when a projected configuration document repeats a key, the projection's locate() resolves every occurrence to the line of the first one.

Measured with the shipped binary, not inferred:

• a binding-only scope: frontmatter probe over tests/corpus/clean/persistence-legitimate-hooks-config.json reports 8 findings, every one at line 10; over persistence-root-form-hooks-config.json, 4 findings, every one at line 8;
• a throwaway url rule over persistence-corporate-audit-endpoint.json reports 3 findings, every one at line 11, although the three URLs sit on different lines;
• PI077 itself, on a three-hook document whose two sensitive commands sit at lines 9 and 13: both findings report line 9.

Why it matters: two consumer-visible mechanisms key on the line number. # injection-scanner:ignore PI077 becomes unusable for one command in a multi-hook file (the directive is resolved per line), and a genuine second finding cannot be suppressed independently. .github/code-scanning-baseline.json fingerprints embed the line, so several distinct findings collapse onto one baseline entry and accepting one accepts them all. This lands squarely on the CAT-03 structural arm, which is the first pattern set to match repeated command / bash keys in one document at scale.

Not diagnosed: whether the collapse is in the projection's path-to-line map or in how the structural pass reports a ProjectedLine.

Filed at the close-out of Phase 5 (CAT-03, #35), plan 05-07 Task 2, from .planning/phases/05-persistence-lifecycle-hijack-cat-03-35/deferred-items.md. Nothing here is fixed in v0.2.0.