audio/ownership: refuse an ambiguous contract fixture

Producer half of the same fix (Codex phase-1 review, finding 3, P2).
This side collected fixture lines into a map, so a duplicated key
silently took the last value while pixelpass took the first — both
repos green on different contracts.

Mutation-verified in both repos with a duplicated `prop_value`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/audio/ownership.rs

@@ -234,7 +234,15 @@ mod tests {
     /// The contract file, byte-identical to pixelpass's copy.
     const FIXTURE: &str = include_str!("../../tests/fixtures/ownership-tag-contract.txt");
 
+    /// ⚠️ **Rejects duplicate keys, and that is the point** (Codex phase-1
+    /// review, finding 3). This side collected into a map, so a duplicate
+    /// silently took the *last* value; pixelpass's half searches a list and
+    /// takes the *first*. A byte-identical fixture with a duplicated key
+    /// could therefore leave both suites green while the two repos had
+    /// selected different contracts — the exact drift this file exists to
+    /// prevent. Both sides now refuse the ambiguity instead of resolving it.
     fn fixture() -> BTreeMap<String, String> {
+        let mut seen: Vec<&str> = Vec::new();
         FIXTURE
             .lines()
             .map(str::trim)
@@ -243,6 +251,11 @@ mod tests {
                 let (key, value) = line
                     .split_once('=')
                     .unwrap_or_else(|| panic!("fixture line is not key=value: {line:?}"));
+                assert!(
+                    !seen.contains(&key),
+                    "fixture defines {key:?} twice; the two repos would disagree on which wins"
+                );
+                seen.push(key);
                 (key.to_string(), value.to_string())
             })
             .collect()