fix: stabilize scm observer dispatch

[VenkataSakethDakuri]

• Make SCM observer dispatch order deterministic so lifecycle notifications are stable across polls.
• Order observations by session, then PR number, then key to avoid randomized map iteration.

[whoisasx]

Thanks for making the lifecycle dispatch order deterministic. The sorting direction itself looks fine, but there is one regression in the same patch: tracked PR repo reconstruction now drops Owner/Name, while the GitHub provider still needs those fields for REST/GraphQL calls.

Once that tuple is normalized correctly again, this should be good to go.

[whoisasx]

This regresses tracked PR refreshes because the GitHub provider still builds REST/GraphQL requests from SCMRepo.Owner and SCMRepo.Name. Returning only Provider, Host, and Repo means a persisted PR such as upstream/api can later be refreshed with empty owner/name fields, so guard/fetch/review calls target an invalid repository and the observer stops updating that PR. Can we keep parsing pr.Repo into owner/name here, or centralize that normalization before provider calls?