I have a question though.. you mention the use of rel canonical to solve the lesser second half of the problem.. What is that second problem? Shouldn't just the redirects be enough?
Btw, I have grown to prefer netlify.toml over the _redirects, etc. cookie files; esp. for CSP rules.
> I encountered that with Netlify's deploy previews (which it can be set to generate for pull requests or with draft builds)
Hmm, OK. So far, I haven't encountered duplicate pages. Netlify has an inbuilt env var $DEPLOY_PRIME_URL (e.g. it would be https://BR--SITE.netlify.com for a BR branch) [and similar for deploy previews]. I use that as BaseURL in #gohugo. So the page URLs are branches vs deploy previews vs production build are unique..
That said, I'll watch out for issues with just 301's.