Cap merge_nearby_stops by stop_radius_m — a merged stop is one place

[rslayer]

Cap the transitive merge by stop_radius_m — a merged stop is one place

Implements the confirmed decision (stop radius wins): a merged "stop" can never be wider than one stop's radius, so a slow GPS walk/drift no longer masquerades as a single wide stop.

Product change (stops.py + insights.py): merge_nearby_stops gains stop_radius_m (threaded from options.stop_radius_m). A stop joins the current merged group only while within stop_radius_m of the group's fixed anchor (first member) — O(1) per stop, no reintroduction of the cycle-9 O(n²). Beyond that, it starts a new group. merge_stops_within_m still gates whether neighbours are close enough to consider, but stop_radius_m bounds the result. ADR 0013.

Verified by local A/B (not implemented via the loop — see note)

• All merge tests green; zero regressions across the full suite; cycles 1–10 green.
• O(n): 0.003→0.006→0.012→0.025 s at 1k→8k stops (clean 2×/doubling).
• Byte-identical when the cap never trips: 0-diff over 2000 random within-radius merges (the added condition is a provable no-op off the cap).

⚠️ Test changes to review (this is a semantic shift)

Six existing merge tests set stop_radius_m = 5 with merge = 45 and asserted an 80–175 m chain fully merges — the exact behaviour the cap changes. I updated them conservatively:

• 4 pure-geometry tests (single-linkage, centroid, radius): only the stop_radius_m config was raised so the chain legitimately fits one stop — assertions unchanged, so they still verify what they did before.
• perf test: now asserts the drift chain splits under the cap (still O(n)) instead of all-merging (which the cap makes impossible).
• heavy_dwell: reframed from "asserts the buggy wide merge" to "asserts every reported stop stays bounded (radius_m ≤ stop_radius_m)" — a stronger assertion.
• new test_merge_nearby_stops_span_cap_splits_walk.py: a progressive walk must split into bounded stops.

Why this came as a direct PR, not a loop cycle

The loop's cycle-11 run was degraded (build work reached no branch; adversary/robustness hit max-turns), and the cap requires rewriting contradictory tests — which the loop is forbidden from doing (it may not change test assertions). So I implemented it directly and verified hard. You can still run the loop's adversary against this branch.

Next: progressive-movement rejection in detect_stops — a continuous walk currently reports phantom stops even without merging (the deeper half of your "a walk isn't a stop" point).