fix(compilers/openapi): read a repeated mapping key as its last value

[OmarAlJarrah]

Summary

The cycle pre-scan read a mapping that declares the same key twice as first-key-wins. That is the
opposite of what the library reading the document does, and the difference is enough to lose a real
cycle.

Speakeasy does not refuse a duplicate key. It reports a validation-duplicate-key warning and
unmarshals every occurrence in turn, so the last value is what the resolver then works from — for a
map member and for a repeated $ref alike:

components:
  schemas:
    B: {type: object}
    B: {contentSchema: {$ref: '#/components/schemas/B/contentSchema'}}

The scan saw only the concrete first B, reported the document clean, and let the self-referential
second one through to the resolver, which dies with fatal error: stack overflow — the unrecoverable
crash the scan exists to prevent (GitHub #12, #26).

The change

Explicit keys now resolve to the last occurrence, at that occurrence's position.

Merge-key precedence is unchanged and is now deliberately a separate step. The two rules point in
opposite directions — a repeated explicit key resolves to its last value, while a merged key yields
to an explicit one and to any earlier merge source — so they cannot share one deduplication pass.
dedupeLastWins handles the former, appendUnseen the latter, and dedupeFirstWins is now just the
merge-sequence case expressed in terms of it.

How it was found

FuzzCycleDetector, mutating the committed cycle reproducers. It reached the failure in ~2 minutes,
reported as fuzzing process hung or terminated unexpectedly — a worker dying on the stack overflow
rather than failing an assertion.

Test plan

• The fuzzer's input is committed at compilers/openapi/testdata/fuzz/FuzzCycleDetector/…, so a
  plain go test replays it.
• testdata/openapi/cycle_duplicate_key.yaml is a readable hand-written version of the same shape,
  registered in cycleReproducers so both TestDetectCycles_Reproducers and
  TestCompile_CyclicSpecDoesNotCrash cover it, and in the harness corpus's knownInvalid set.
• Reverting only the precedence rule — dedupeLastWins back to dedupeFirstWins — crashes the test
  binary on that fixture. That is what makes it a regression guard rather than a fixture that merely
  parses.
• New whitebox cases for the expansion: last-wins on a repeated key, that it keeps the last
  occurrence's position, and that a merged key still yields to a repeated explicit key (the two rules
  composing).
• gofmt -l ., go vet ./..., golangci-lint run (0 issues), go test ./..., and
  ./scripts/check-coverage.sh (100.0% total, 100.0% every package) all pass.