fix(v2.0): process duplicate BlueField serials once

[williampnvidia]

Backport of #3356 to release/v2.0.

Dell iDRAC can copy a BlueField part number and serial number onto an unrelated PCIe record. Site Explorer iterates every host PCIe record, so the duplicated identity causes the same physical DPU to be counted and processed twice during ingestion.

This change tracks nonempty serials from records with recognized BlueField part numbers during each host ingestion pass. When another BlueField-classified record repeats a serial, Site Explorer logs a warning and skips the second record_host_dpu_device call.

The backport is patch-identical to the mainline fix. Raw endpoint inventory and derived MLX inventory output remain unchanged.

Related issues

• Mainline PR: fix(site-explorer): process duplicate BlueField serials once #3356
• Ingestion bug: Site Explorer ingestion should process repeated BlueField serials only once #3324
• Deferred MLX inventory reporting: site-explorer mlx-devices should suppress duplicate BlueField PCIe records #3352

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Validated on Linux against this backport commit:

• Focused duplicate-BlueField-serial regression test
• Full carbide-site-explorer library test suite
• cargo check -p carbide-site-explorer --lib
• Repository format check
• cargo make --no-workspace clippy-flow

Additional local validation:

• Focused carbide-site-explorer Clippy with warnings denied
• Gitleaks and sensitive-host-detail scans

Additional Notes

This PR targets release/v2.0 for inclusion in a future v2.0 release candidate. Release Management should perform the merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c1b3ad6a-96e6-4093-bb1a-65be7d6a885c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-07-10 15:20:51 UTC | Commit: 11d328e}

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	271	13	34	91	7	126
machine-validation-runner	804	40	237	296	36	195
machine_validation	804	40	237	296	36	195
machine_validation-aarch64	804	40	237	296	36	195
nvmetal-carbide	804	40	237	296	36	195
TOTAL	3493	173	982	1281	151	906

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.

[nv-dmendoza]

LGTM, fixes an issue we are seeing elsewhere