ci-secure: per-file dedupe of coverage-gap entries is not pinned by a test

When the scanner can't fully read/parse a workflow, it records the gap in scan_incomplete / dropped_matches, and the report renders the affected files in the incomplete-coverage warning. The de-duplication of these entries per file is not currently covered by a test, so a future change could re-introduce duplicate coverage-gap lines (the same file listed twice) without failing the suite.

Ask: add an oracle test pinning that each file appears at most once in the coverage-gap blockquote, so the dedupe can't silently regress.

Found during the ci-secure launch-readiness review (panel P8).