Deduplicate findings and separate governance from cost

[mamu0]

What

Unifies findings from AZQR, Azure Advisor and the live-scan custom analyzers on a resourceId + recommendationId key, and separates governance/diagnostic observations from actual billable waste.

Why

The same waste (e.g. an unattached disk) could be reported once per source, inflating the report and making the FinOps signal noisy. Governance findings (missing tags, wrong location, ...) were also tagged category: "cost", suggesting a "saving" that doesn't exist and risking false dedup matches.

How

• Finding gains an optional recommendationId, normalised onto a shared vocabulary: orphan.<resourceType> for orphaned resources (any source), advisor.<recommendationTypeId>, azqr.<recommendationId>.
• New azure/finding-dedup.ts: foldDuplicateFinding collapses an incoming AZQR finding onto an already-collected one for the same resource, keeping max severity + the only available monetary estimate, and annotating the corroborating source (Also flagged by azqr as an orphaned resource.). Applied during ingestAzqrReport. Findings without a recommendationId (all custom sentence-level findings today) never participate - no guesswork dedup.
• New azure/finding-category.ts: custom analyzer sentences about missing tags, unpreferred location, unsupported resource type, or a failed detail lookup are now operationalExcellence instead of cost.
• The Azure Advisor Cost query (Category eq 'Cost') is unchanged - it remains the only source of estimatedMonthlySavings.

Testing

pnpm nx run-many -t test typecheck lint build format:check -p @pagopa/dx-savemoney @pagopa/dx-cli - all green, 186 tests in savemoney (+26).

Or local usage:

pnpm nx build @pagopa/dx-cli --skip-nx-cache
azqr scan --subscription-id 0000 --mask=false --json
node ./apps/cli/bin/index.js savemoney --azqr-report ./azqr_action_plan_xxxx_yy_zz_T123456.json --format lint > savemoney_result.md

Example result:

Resolves: CES-2193