fix: never dedupe hash-less report rows across backends

An extract/count()/group_by query returns synthetic rows with no report
hash, which reportKey fell back to keying by verbatim raw bytes. Two
backends emitting a byte-identical aggregate row (e.g.
{"status":"changed","count":1}) therefore collapsed into one, silently
undercounting the merged result and contradicting the documented
guarantee that no backend's rows are dropped.

Give the mergeUnion key func an ok return: false means the record has no
dedupe identity and is always kept. reportKey returns ok=false for
hash-less rows; hash-keyed report dedupe and event verbatim-identity
dedupe are unchanged.

Add TestMergeUnion_IdenticalHashlessRowsAreNotCollapsed covering the
collision case, and reword the README line to say aggregate rows pass
through even when byte-identical.

server.go

@@ -127,7 +127,7 @@ func (s *Server) serveMerged(w http.ResponseWriter, r *http.Request, path string
 // and events — and serves the deduped union of every backend. Because each
 // backend ordered and paged only its own slice, the union is re-ordered and
 // re-paged here from the client's order_by/limit/offset.
-func (s *Server) serveUnion(w http.ResponseWriter, r *http.Request, path string, key func(record) string) {
+func (s *Server) serveUnion(w http.ResponseWriter, r *http.Request, path string, key func(record) (string, bool)) {
 	in := r.URL.Query()
 	page, err := parsePaging(in)
 	if err != nil {