host/taint: refuse an ambiguous contract fixture instead of resolving it

Codex phase-1 review, finding 3 (P2), concrete half. This side searched
a list and took the first match for a key; peerspeak's side collected
into a map and took the last. A byte-identical fixture containing a
duplicated key would therefore leave both suites green while the two
repos had selected *different* contracts — the precise drift the shared
file exists to prevent.

Both sides now assert the key is not already defined. Verified by
appending a duplicate `prop_value` to both fixtures: both suites fail.

The rest of finding 3 — one CI gate that feeds peerspeak's real
tag_child output through this repo's actual adapter and classifier,
rather than two per-repo literal tests — is a larger piece of work and
is not attempted here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/host/taint/tests.rs

@@ -241,6 +241,17 @@ fn ownership_carriers_match_the_cross_repo_fixture() {
         .filter(|line| !line.is_empty() && !line.starts_with('#'))
         .map(|line| line.split_once('=').expect("fixture line is key=value"))
         .collect();
+
+    // ⚠️ Refuse a duplicated key rather than resolving it (Codex phase-1
+    // review, finding 3). This side takes the first match and peerspeak's
+    // took the last, so a duplicate in a byte-identical file could leave both
+    // repos green having selected *different* contracts.
+    for (index, (key, _)) in pinned.iter().enumerate() {
+        assert!(
+            !pinned[..index].iter().any(|(seen, _)| seen == key),
+            "fixture defines {key:?} twice; the two repos would disagree on which wins"
+        );
+    }
     let get = |key: &str| -> &str {
         pinned
             .iter()