[josegonzalez]

The catalog now publishes unique: true on a list whose members must be distinct, and validation rejects a member that repeats an earlier one, reported at the later member's path and skipped for unknown values. dokku_config's preserve, dokku_storage_mount's phases (on the task and on each mount) and dokku_scheduler_k3s_profile's kubelet_args are declared unique, and every unordered list is now either an identity collection or unique, so a consumer can model each one as a set. A repeated kubelet_args member is an exact key=value repeat; one key with two different values is two arguments and is still accepted.

Decisions: an identity collection does not carry unique, since its item identity already makes members distinct, and a test holds every unordered list to exactly one of the two. The repeat check holds in every state, so a repeated phase on a mounts item is now refused under absent too, where the old hand-written check skipped it; that check is removed in favour of the declared one. dokku_scheduler_k3s_profile's Validate() now runs the declared constraints first like other tasks, so it refuses a repeat as Plan and docket validate do. The violation message names paths rather than the repeated value.

Closes #648