fix: refresh module caches by source identity

[Brian Krabach (bkrabach)]

Summary

module_update could report a successful refresh while leaving the stale cache in place when a module entry or bundle name differed from the repository name. It also selected cache entries by a derived semantic name, which could remove an unrelated repository or ref with the same label.

Fix

• Refresh through Foundation's GitSourceHandler.update() using the exact configured repository URL and ref under Foundation's cache lock.
• Keep existing progress callbacks and public API labels unchanged; labels remain presentation-only.
• Add local-git regression coverage for mismatched bundle/module identities, legacy provider paths, .git URLs, ref/repository isolation, failure propagation, and selective Click update behavior.
• Document the source-identity invariant in AGENTS.md.

Verification

• uv run pytest tests/test_module_cache.py — 9 passed.
• Qualification matrix: Python 3.11.16, 3.12.14, and 3.13.15; 2,462 passed, 4 skipped, 13 deselected, 1 expected failure per default run; 13 integration tests passed; 9 focused regression tests passed per interpreter.
• Installed-candidate CLI exercised two successive updates (old → new → newer) with unrelated refs and repositories preserved.

Cross-platform CI passed: https://github.com/microsoft/amplifier-app-cli/actions/runs/35960784045 (all eight test jobs passed across Ubuntu, macOS, and Windows; CLA passed). No merge or auto-merge is enabled by this PR.