fix: never dedupe hash-less report rows across backends

An extract/count()/group_by query returns synthetic rows with no report
hash, which reportKey fell back to keying by verbatim raw bytes. Two
backends emitting a byte-identical aggregate row (e.g.
{"status":"changed","count":1}) therefore collapsed into one, silently
undercounting the merged result and contradicting the documented
guarantee that no backend's rows are dropped.

Give the mergeUnion key func an ok return: false means the record has no
dedupe identity and is always kept. reportKey returns ok=false for
hash-less rows; hash-keyed report dedupe and event verbatim-identity
dedupe are unchanged.

Add TestMergeUnion_IdenticalHashlessRowsAreNotCollapsed covering the
collision case, and reword the README line to say aggregate rows pass
through even when byte-identical.

reports_test.go

@@ -35,6 +35,16 @@ func TestMergeUnion_HashlessRowsAreAllKept(t *testing.T) {
 	}
 }
 
+func TestMergeUnion_IdenticalHashlessRowsAreNotCollapsed(t *testing.T) {
+	// Two backends can legitimately produce the same aggregate row; collapsing
+	// them as duplicates undercounts the merged result.
+	same := `{"status":"changed","count":1}`
+	merged := mergeUnion([]backendResult{recs(t, "old", same), recs(t, "new", same)}, reportKey)
+	if len(merged) != 2 {
+		t.Errorf("expected both backends' aggregate rows, got %d: %v", len(merged), merged)
+	}
+}
+
 func TestMergeUnion_EventsDedupeOnRawIdentity(t *testing.T) {
 	same := event("h1", "r1", "Package[nginx]")
 	other := event("h1", "r1", "Service[nginx]")