Address PR review:
1. Strict-by-default fork filter in `detectPR` — require the head owner
to be a non-empty string AND match the project repo owner. A null,
undefined, or empty `headRepositoryOwner.login` (e.g. deleted account
or future gh API change) no longer silently passes the filter.
2. Update existing same-repo cache/draft tests to include
`headRepositoryOwner: { login: "acme" }` since the strict filter
would otherwise reject them as fork PRs.
3. Add a regression test that null/missing `headRepositoryOwner` is
rejected.
4. Add an independent restore test for the `pr.state === "closed"`
branch of session-manager's step 3a (previously only `merged` was
covered).
Refs #1724.
4043fa4a47