Filter stale and duplicate SHIP/SLAP discovery records

[BraydenLangley]

Summary

• install centralized SHIP/SLAP admission and storage denylist controls so GASP cannot restore evicted domains
• evict denied and semantic-duplicate records with an in-database backup before each protected deployment
• live-probe public discovery providers and semantically deduplicate root responses while blocking private-address probe targets
• revoke duplicate controller-owned advertisements and pin @bsv/sdk 2.4.1

Validation

• npm test (26/26)
• npm audit --omit=dev (0 vulnerabilities)
• generated preload node --check
• bash -n scripts/k8s/*.sh
• git diff --check