fix: never dedupe hash-less report rows across backends

An extract/count()/group_by query returns synthetic rows with no report
hash, which reportKey fell back to keying by verbatim raw bytes. Two
backends emitting a byte-identical aggregate row (e.g.
{"status":"changed","count":1}) therefore collapsed into one, silently
undercounting the merged result and contradicting the documented
guarantee that no backend's rows are dropped.

Give the mergeUnion key func an ok return: false means the record has no
dedupe identity and is always kept. reportKey returns ok=false for
hash-less rows; hash-keyed report dedupe and event verbatim-identity
dedupe are unchanged.

Add TestMergeUnion_IdenticalHashlessRowsAreNotCollapsed covering the
collision case, and reword the README line to say aggregate rows pass
through even when byte-identical.

README.md

@@ -59,7 +59,7 @@ unknown fields survive untouched.
   on `hash`; events, which carry no id of their own, dedupe on the verbatim
   record (a node briefly reporting to both PuppetDBs stores identical records in
   each). Records the merge cannot key — `extract`/`group_by` aggregate rows — are
-  all kept rather than collapsed, so no backend's rows are silently dropped;
+  never deduped, so every backend's rows pass through even when byte-identical;
   summing those aggregates across backends is not implemented yet.
 
 ### Paging and ordering on the merged endpoints