fix(quality): skip rolling-hash precompute when no full clone window exists

[alxxjohn]

Motivation

• Prevent an attacker-controlled large clone_token_threshold from triggering an unbounded CPU loop during the rolling-hash precomputation in clone detection.

Description

• Add an early eligibility check in cloneWindowIndex that returns immediately when no document contains at least threshold tokens, avoiding the threshold-sized multiplier loop.
• Preserve existing clone-detection behavior for normal thresholds and documents by only short-circuiting when no full window is possible.
• Add a regression test TestCloneWindowIndexSkipsMultiplierForOversizedThreshold that calls cloneWindowIndex with a very large threshold and two single-token documents to ensure the fast-path returns an empty index.
• Files changed: internal/codeguard/checks/quality/quality_clone.go (early check) and internal/codeguard/checks/quality/quality_clone_test.go (new test).

Testing

• Ran go test ./... and the test suite completed successfully.
• Ran go test ./internal/codeguard/checks/quality ./tests/checks and package-specific tests passed.
• Ran git diff --check to validate formatting and whitespace and it reported no problems.

---

Codex Task