updater: stop whole-repository --update from looping (#113)

[anhnh2002]

Fixes #113.

Problem

A baseline generated in whole-repository mode (module_tree.json == {}, one overview.md, typically from a narrow --include) and then updated with --update against a wider scope ran for hours and produced dozens of colliding pages (overview_approval.md, overview_overview_approval_2.md, _3, ...).

Traced in the code:

1. orchestrator.py forced ratios["fired"] = False in whole-repo mode, so the fallback-to-full-build rule could never fire, whatever the size of the current scope.
2. The virtual single leaf was then fed every leaf node of the current repo, not the baseline's scope.
3. The routing agent created a new leaf for each orphaned added component. Every leaf maps back onto the one overview page, so Step 5 deleted and rewrote overview.md once per created leaf. Each rewrite fanned out the same sub-modules again.
4. generate_sub_module_documentation resolved name collisions by appending _2, _3, ... so the repeated fan-out never converged.

Fix

• Gate the whole-repo fallback on the clustering threshold. If the current scope's clustering tokens exceed max_token_per_module (the same threshold a fresh build uses to decide whether to cluster), the update returns full_fallback; the CLI already handles that by preserving the old docs and rebuilding. The record now carries clustering_tokens and tau_cluster.
• Whole-repo mode routes orphans to the single page with no LLM call and no created leaves, and Step 5 runs the overview exactly once.
• Duplicate sub-module requests are skipped, not suffixed. plan_sub_module_specs keeps the issue LLM-chosen module names collide in flat output directory, silently overwriting or losing documentation files #76 parent-prefix behaviour, but a request whose plain and prefixed names both exist is reported back to the agent as already documented, with an explicit instruction not to request it again.