[Bug] Fix merged pull request ordering validation in GitHub merger #835

Description

validateStepIsGitHubStack in runway/extension/merger/github/github_merger.go contains an ineffective validation check. It checks the prefix of pull requests returned by unmergedPulls, even though that prefix contains only already-merged pull requests.

As a result, a merged pull request listed after an unmerged pull request can bypass validation and reach the GitHub stack lookup path.

Steps to Reproduce

1. Create a merge step containing multiple GitHub pull requests.
2. List an unmerged pull request before an already-merged pull request.
3. Validate the step using validateStepIsGitHubStack.

Expected Behavior

The merger should reject the step with merger.ErrInvalidRequest because merged pull requests must form a prefix of the list.

Actual Behavior

The ordering check does not detect the invalid sequence, allowing execution to continue into the GitHub stack lookup path.

Environment

• Go version: go1.27.1
• OS: Windows
• Bazel version: 8.4.1

Logs / Screenshots

Not applicable.

Additional Context

The issue can be fixed by validating the suffix returned by unmergedPulls and rejecting any already-merged pull request found in that suffix. Regression tests should cover both valid and invalid pull request ordering.