ci(duplication-guard): a count that drops below its pin leaves slack a later PR can spend, so lower the pin automatically #16324

Follow-up from review of #16323 (#16319).

Under #16319, scripts/duplication_gate.py fails a scope whose duplicated-line count is over its pin. A count under the pin only produces advice ("lower it to N"). So when a PR removes duplication without lowering the pin, the difference becomes slack that a later PR can spend on new clones, and the ratchet gives back ground. #16313 (main scope: 11,652 against a pin of 11,723) and #16239 (SLM scope: 4,690 against 4,729) are the current cases.

Options

• A. Fail under the pin too, the way the file-size ratchet does (repo_tests/python_file_size_ratchet_baseline.py). It's the tightest option, but every PR that removes duplication then has to edit the same env line in duplication-guard.yml. Two such PRs in flight conflict on that line, which is the kind of hotspot docs: the generated env-var table and its count line live in CLAUDE_RULES.md, so every env-var PR conflicts with every other #16317 was just filed to remove.
• B. Keep PRs advisory, and lower the pins after merge. A push-to-Dev_new_gui job sees base below its pin and opens, or updates, one small PR that lowers it. No merge conflicts, and the slack only lasts until that PR merges.
• C. Keep the pins advisory under, and rely on reviewers to lower them. This is what we have today, and it's the gap described above.

Recommendation: B. It closes the slack without making every dedup PR edit a shared line.

Acceptance criteria

• A duplication count that falls below its pin gets the pin lowered to it: by the PR itself (A), or by a follow-up opened automatically (B).
• Under the chosen option, two concurrent PRs that each remove duplication don't conflict. Show this with git merge-tree if A is chosen.