[BasilZafar11]

Repeated configuration keys were all attributed to their first source occurrence. Two identical hook commands on lines 4 and 5 consequently reported lines 4 and 4, letting a line-specific ignore suppress both. They now report their own lines, and either occurrence can be suppressed independently.

Closes #165.

Changes

• Replace the leaf-key text search with a position tree traversed by the full configuration key/index path. Covers JSON/JSONC, YAML, and TOML without depending on object traversal order or distinct scalar values.
• Use marked YAML events for YAML/JSON positions and immutable TOML spans for TOML. Semantic parsing and projection text stay unchanged. YAML aliases point to their reference; duplicate JSON members point to the surviving last member. Correct the JSON block offset after leading blank lines.
• Bound source-tree depth, node collection, and alias expansion. Normalize JSON string escapes only for the position pass so surrogate pairs and Unicode separator characters do not disable or shift source mapping.
• Add 14 regression tests, including the three existing clean hook fixtures cited by the issue, independent PI077 suppression, and accepting one finding while leaving the second occurrence visible.
• Refresh baseline source-line metadata: all 378 identity/digest/count tuples are unchanged; four first_seen_line values are corrected. Baseline identity already excludes line numbers, so the fingerprint algorithm and count budget remain unchanged.

yaml-rust2 0.10.4 adds source marks with encoding features disabled (four transitive packages). toml_edit 0.22 was already a locked dependency and is now used directly for spans. ADR-007 records the decision and fallback limits. README explains the corrected suppression behavior. No detection patterns, severities, report schemas, or recall expectations changed.

Validation

• cargo test --locked --no-fail-fast -- --skip findings_name_the_repository_path_not_the_staging_copy: 493 passed, 0 failed, 1 filtered out in the final full run. The existing Windows-only assertion is excluded because it expects docs/CLAUDE.md while Windows reports .\docs\CLAUDE.md; its test and implementation are unchanged. An earlier catalogue check encountered Windows checkout line endings; regenerating the catalogue fixed it with no Git content diff.
• Focused source-line, frontmatter, YAML compatibility, and catalogue checks: 71 passed.
• Clippy with --all-targets --locked -- -D warnings, formatting, and diff checks pass.
• Release build and all four release benchmark smoke checks pass. Existing performance guards pass in the full suite.
• Whole-repository scan using the regenerated native baseline exits 0. Committed baseline paths follow the existing POSIX convention; normalization leaves fingerprints/counts untouched.

Branch created from freshly fetched upstream main e1bf8b6; fork main matches that commit. No production unwraps or debug output added. Existing clean specimens and sealed held-out payloads are unchanged.