feat(cicd_rules): duplicate_cron_schedule (#362)

[hyperpolymath]

What

Implements #362 — a Hypatia.Rules.CicdRules detector, duplicate_cron_schedule, for the runner-waste / log-noise pattern where a workflow's on.schedule lists redundant cron: triggers. Two shapes (severity :medium, advisory):

1. Same day-of-week — ≥2 entries sharing the 5th cron field (e.g. three * * 1 Monday crons inherited from a workflow consolidation).
2. Daily subset — a daily * * * entry and a day-specific entry at the same HH:MM; the specific one is strictly covered by the daily one.

Distinct intentional triggers (different HH:MM, or different if: gates on the same day) are not a strict subset and are only advisory under shape (1) — never auto-removed.

How

• CicdRules.scan_duplicate_cron_schedules/1 — walks .github/workflows/*.{yml,yaml} (root + nested) and returns findings per file.
• CicdRules.check_duplicate_cron_schedules/2 — pure (path, content) -> [finding]; ignores non-5-field cron lines and commented-out # - cron: lines.
• Finding shape %{rule: :duplicate_cron_schedule, severity: :medium, file:, reason:, fix:, crons:}.
• Surfaced via the Hypatia.Rules facade defdelegate; CHANGELOG (md + adoc).

Tests

test/rules/cicd_rules_duplicate_cron_test.exs — sensitivity (3-Monday + daily-subset) and specificity (different-time non-subset, single cron, commented-out lines), plus a scan_/1 walk test. Oracles taken from the real hypatia#331 fix (tests.yml, verify-proofs.yml) and hypatia's current security-policy.yml (correct negative).

Verified at source (local Elixir 1.14 — mix deps can't be fetched in this session)

• mix format clean (formatter-normalized; delta isolated from 1.14↔1.17 version skew)
• isolated elixirc on cicd_rules.ex → 0 warnings / 0 errors
• the real compiled module run against every oracle above → all pass

Closes #362

---

Generated by Claude Code