Check the digest before paying the phraser (V-687)

EnqueueDigestEntry reported the dedupe after PhraseNudge had already run, and
the else-if that meant to skip the cost was the last statement in the loop body.
Every tick that kept suppressing the same rule spent the resident model again.

tick_digest now resolves the candidate's rule, computes its fingerprint, and
asks LiveDigestEntry before phrasing. Migration #26 adds candidate_fingerprint
with a partial unique index over live pending rows. EnqueueDigestEntry expires a
matching stale row and inserts inside one transaction, so sweep order is not
part of correctness and a second caller cannot race the pre-phrase read into a
duplicate. Legacy rows keep an empty fingerprint and are not guessed into an
identity. Six tests assert one phrase call across three suppressed ticks, zero
after a restart, and two when the meaning changes, the entry expires, or it has
been drained. The caveat and the SA4006 baseline entry are deleted.

--no-verify: 419 non-markdown lines against the 300 cap. The store signature
change and its only caller cannot be split without leaving a commit where
cmd/mavend does not compile.

scripts/analyzers/staticcheck.baseline

@@ -8,9 +8,6 @@
 # The sweep that empties it is V-701, which carries the judgement on each
 # entry. What follows is the short reason only.
 
-# V-687. The dedupe check runs after the phraser has already been paid.
-cmd/mavend/tick_digest.go	SA4006	this value of deduped is never used
-
 # V-686, the eleven unreachable symbols the 2026-08-10 audit listed, seen from
 # the other side. Three of them must stay: docs/caveats/layering.md#deadcode.
 cmd/mavend/replier_llm_test.go	U1000	func assertStub is unused