test(er): resolv-determinism — match-pairs behöver hard-rule decided_by

_apply_matches ignorerar medvetet decided_by=score (defence in depth:
score/fuzzy får aldrig skapa canonical identity-länkar) — testernas
stub-bridge returnerade score-pairs och förväntade ändå merge → CI-fail var
implementationen som hade rätt. Pairs är nu decided_by=stable-identifiers.v3.

Verifierat: pytest services/api/tests 6+14 pass, full unit 945/945,
typecheck EXIT 0, real-Postgres 5/5.

services/api/tests/test_resolve_determinism.py

@@ -70,7 +70,12 @@ async def test_canonical_match_merges_and_stamps_provenance(monkeypatch):
         assert body["tenant_id"] == "tenant-a"
         assert body["blocking_fields"] == ["market", "block_initial"]
         a, b = body["records"][0]["record_id"], body["records"][1]["record_id"]
-        return httpx.Response(200, json={"pairs": [_pair(a, b)], "review_queue": []})
+        # Endast hard-rule-beslut (decided_by != score/None) far skapa en
+        # canonical identity-lank - consumenten ignorerar medvetet score/"match".
+        return httpx.Response(
+            200,
+            json={"pairs": [_pair(a, b, "match", "0pt.company.stable-identifiers.v3", 0.99)], "review_queue": []},
+        )
 
     route.side_effect = responder
     result = await resolve(records, tenant_id="tenant-a", project_id="project-a")
@@ -123,8 +128,8 @@ async def test_hard_non_match_blocks_transitive_cluster_merge(monkeypatch):
             200,
             json={
                 "pairs": [
-                    _pair(a, b, "match", "score", 0.98),
-                    _pair(b, c, "match", "score", 0.97),
+                    _pair(a, b, "match", "0pt.company.stable-identifiers.v3", 0.98),
+                    _pair(b, c, "match", "0pt.company.stable-identifiers.v3", 0.97),
                     _pair(a, c, "non_match", "0pt.company.stable-identifiers.v2", 0.0),
                 ],
                 "review_queue": [],