def dedupe_rows(rows):
    return [accepted, rejected, provenance]

1. the duplicate key is normalized (text stripped and lowercased, label as-is)
2. the first occurrence under each key survives
3. rejected is a list of (index, reason) with reason 'duplicate'
4. provenance maps a rejected index to 'duplicate-of:<first index>'
5. the result order follows the input order
6. rows already rejected by the row contract are not accepted here

• rejected entries carry the ORIGINAL index in the input list
• provenance has an entry for every duplicate rejection
• no mutation of the input rows