chore: update slophammer to v0.3.0 and deduplicate flagged blocks

[osolmaz]

Summary

CI ran slophammer with @latest, so the 0.2.0 config cutover was about to break every run, and the old flat slophammer.yml keys are now a hard config error.
This change pins slophammer to v0.3.0, migrates the config to the nested shape, and makes the gates actually count: 0.3.0 only credits CI steps scoped to the Go module, so the slophammer steps now run from backend/ with the dedicated slophammer-go binary.
The newer DRY engine also found three real copied blocks that the old version missed; they are deduplicated here so the gate passes honestly instead of being raised.

What Changed

The slophammer wiring moved to the current release, and the code it flagged was cleaned up.

• slophammer.yml: flat 0.1.x keys (coverage_threshold, dry_max_candidates, dry_paths, crap_max_score, mutation_targets) migrated to the nested shape (coverage.threshold, dry.max_findings/paths/exclude, crap.max_score, mutation.targets). Boundaries unchanged.
• Both workflows: cmd/slophammer@latest → cmd/slophammer-go@v0.3.0, with working-directory: backend and .. as the check root. 0.3.0's binding-evidence rules only credit steps reachable from the Go module, so the old root-level umbrella invocations no longer counted as enforcement.
• internal/translation/manager.go: the article title/text task construction existed twice; both sites now use one appendArticleTranslationTasks helper.
• internal/app/tags.go: tags create and tags update built the same six-flag set independently; both now use one newTagAttributeFlagSet helper.
• internal/app/person_identities.go: show and archive shared their whole parse-and-run skeleton; both are now thin wrappers over runPersonIdentityCommand.

Testing

I ran the gates locally against the released v0.3.0 binary and the refactored packages' tests.

• slophammer check . — OK, scope: 71 of 71 production files
• slophammer-go dry .. — 0 candidates (was 3)
• slophammer-go mutate .. --scan — passes
• go build ./..., go vet, and go test for internal/app and internal/translation — tag, person-identity, and translation tests all pass
• Not tested locally: the CRAP and executable gates need the Postgres service, so they are verified by this PR's CI.

Risks

The dedup refactors are behavior-preserving extractions and the affected command tests pass, but they touch three production files, so review attention should go there rather than to the mechanical config migration.
Two internal/app tests fail on macOS due to /private/var symlink resolution; they are unrelated path-resolution tests and pass on Linux CI.