fix: CLI build/update/watch now run post-processing (signatures, FTS, flows, communities)

[igagankalra]

Extract the 4-step post-processing pipeline from tools/build.py into a shared postprocessing.py module and wire it into all CLI entry points so that build, update, and watch produce the same complete graph as the MCP tool.

• Add code_review_graph/postprocessing.py with run_post_processing()
• tools/build.py now delegates to run_post_processing() (no duplication)
• cli.py calls _cli_post_process() after build and update commands
• watch() accepts on_files_updated callback, invoked after each flush
• 18 new tests covering all steps, isolation, idempotency, and watch

Closes #93

[igagankalra]

I've put up a focused fix for this issue on my fork: igagankalra:fix/cli-post-processing (main...igagankalra:code-review-graph:fix/cli-post-processing)
Why a separate PR instead of relying on #95
PR #95 incidentally patches build and update as part of a much larger feature PR (10 new CLI subcommands + CommonJS require() parsing — 633 lines). The #93 fix is ~65 lines buried in that diff, and it has a few gaps:

1. Code duplication — feat: CLI-first expansion — 10 subcommands + CommonJS require() parsing #95 copy-pastes the post-processing logic into cli.py as _run_post_processing(), leaving the original copy in tools/build.py untouched. Two copies that can drift.
2. Watch mode still broken — feat: CLI-first expansion — 10 subcommands + CommonJS require() parsing #95 doesn't touch watch(), which is the third affected entry point listed in this issue.
3. No tests for the post-processing path itself.
   What the focused fix does differently

• Extracts the pipeline into a shared postprocessing.py module — single source of truth, tools/build.py delegates to it (−65 lines of duplication).
• Wires it into all three entry points: build, update, and watch (via an on_files_updated callback on _flush()).
• 18 new tests covering signatures, FTS, flows, communities, step isolation (each failure doesn't block the next), idempotency, and the watch callback.
  The two PRs are complementary — feat: CLI-first expansion — 10 subcommands + CommonJS require() parsing #95's CLI subcommands and CommonJS parser are valuable features on their own. This fix just ensures CLI build missing post-processing steps that build_or_update_graph_tool MCP tool includes #93 is fully addressed without waiting on a larger feature merge.