fix(agent): dedup detect-mode emits within a window

[nghiadaulau]

Problem

In detect mode a sustained anomaly re-clusters into the same pattern on
every poll, and the worker re-emitted an incident on every tick — even
the cache-hit path (which skips the AI call) still called send(). One
ongoing issue therefore produced a new incident + notification every
poll_interval, spamming channels and the incident store.

Fix

A DedupStore gates emission per (service, pattern) for a configurable
window (agent.emit_dedup_window, default 1h; "0" restores the old
one-per-tick behavior):

• Redis SETNX EX makes the "first emit in the window" check atomic
  across replicas; an in-memory map is the fallback when Redis is
  unavailable, mirroring the existing CursorStore degrade-don't-crash
  pattern.
• Both emit sites (cache-hit and fresh AI call) go through one emit()
  helper that applies the gate.
• Suppressed emits record outcome="deduped" in the detect log (visible in
  the Detect audit view).
• A failed send releases the window (Release) so the next tick
  retries rather than being suppressed for the whole window.

Scope

This is the windowed-dedup correctness fix only. Full incident lifecycle
(burst re-arm on frequency escalation, auto-resolve with hysteresis) is
intentionally out of scope here.

Changes

• pkg/agent/dedup.go — DedupStore (Allow / Release / lazy sweep).
• pkg/agent/worker.go — emit() gate; both send paths refactored through it.
• Config triple-touch: AgentConfig.EmitDedupWindow + clone_config +
  config/config.yaml; Helm agent.emitDedupWindow (values + configmap);
  docs (configuration.md, ai-detect-mode.md).

Testing

• dedup_test.go — allow/release, window expiry, "0" disables, default
  parsing.
• worker_dedup_test.go — emitDetect suppresses the repeat (deduped,
  emitter called once) and retries after a failed send.
• gofmt, go vet, go build ./..., go test -race ./pkg/agent ./pkg/config
  green; helm template renders emit_dedup_window (omitted when empty).

Checklist

• Tests for the new behavior (unit + worker path)
• Config triple-touch + Helm mirrored
• Backward compatible ("0" disables; default fixes the spam)
• Redis-with-memory-fallback; single-replica safe
• House conventions (fix: prefix); docs + CHANGELOG