feat: add neutral SCM observability

[whoisasx]

Summary

• Add internal/scm/logging for provider-neutral SCM field names, event names, correlation IDs, and safe diagnostic helpers.
• Instrument SCM observer and command service flows with started/completed/failed, cache, audit, refresh, snapshot, backoff, and rate-limit logs.
• Instrument GitHub REST/GraphQL transport with neutral request/response/failure/rate-limit logs while avoiding tokens, request bodies, GraphQL queries, comment bodies, response bodies, and CI log tails.
• Keep durable diagnostics concise by attaching normalized failure summaries and avoiding successful transport-call diagnostics on snapshots/results.

Stack

Stacked on #28 / feat/27 because the SCM provider code this issue updates is introduced there.

Closes #45

Tests

• cd backend && go test -count=1 ./...