I fixed `normalizeTags`, and `npm test` now passes.

**What was wrong:** the function removed duplicates by comparing the trimmed strings before lowercasing instead of the final lowercased tags. So `" Beta "` and `"BETA"` were treated as different and `"beta"` came back twice.

**The fix:** in `src/normalize-tags.mjs`, duplicates are now checked against the final lowercased tag. It's a two-line change and nothing else in the function was touched.

I also spot-checked some edge cases against `protected/api-contract.json`, and all behaved as the contract describes:
- Inputs that aren't arrays return `[]`.
- Only the listed ASCII whitespace characters are trimmed; a non-breaking space is not.
- A 20-character tag is kept and a 21-character one is dropped.
- Malformed hyphen patterns (`a--b`, `-a`, `a-`) and non-ASCII letters (`ÄB`) are dropped.
- Output is sorted in ASCII order.

No other files were changed.