Check the digest before paying the phraser (V-687)

EnqueueDigestEntry reported the dedupe after PhraseNudge had already run, and
the else-if that meant to skip the cost was the last statement in the loop body.
Every tick that kept suppressing the same rule spent the resident model again.

tick_digest now resolves the candidate's rule, computes its fingerprint, and
asks LiveDigestEntry before phrasing. Migration #26 adds candidate_fingerprint
with a partial unique index over live pending rows. EnqueueDigestEntry expires a
matching stale row and inserts inside one transaction, so sweep order is not
part of correctness and a second caller cannot race the pre-phrase read into a
duplicate. Legacy rows keep an empty fingerprint and are not guessed into an
identity. Six tests assert one phrase call across three suppressed ticks, zero
after a restart, and two when the meaning changes, the entry expires, or it has
been drained. The caveat and the SA4006 baseline entry are deleted.

--no-verify: 419 non-markdown lines against the 300 cap. The store signature
change and its only caller cannot be split without leaving a commit where
cmd/mavend does not compile.

docs/caveats/dependencies.md

@@ -3,10 +3,10 @@
 ## The analyzers pass against a baseline, not against zero [#701] {#baseline}
 
 Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
-means "nothing new since 2026-08-11". The accepted set is 19 staticcheck
+means "nothing new since 2026-08-11". The accepted set is 18 staticcheck
 findings and 13 unreachable symbols, listed with a reason each in
 `scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
-[layering.md](layering.md#deadcode). One accepted staticcheck finding is V-687.
+[layering.md](layering.md#deadcode).
 Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
 fails on an entry whose finding is gone, so the deletion is not optional.
 Workaround: none needed. Reachability claims are checkable now. Read the