GetLatestMaintainerIdentityObservation(ByRef) returns the worst-ranked profile in a multi-profile group

## Problem

When the LFX enricher writes a multi-profile group (chosen/duplicate rows, see #152/#159), every row in the group shares the same observed_at timestamp - it's the now threaded through enrichMultipleMatches - and rows are inserted in rank order (best/chosen first).

Store.GetLatestMaintainerIdentityObservation and ...ByRef (db/store_impl.go, around lines 1046-1052 and 1067-1073) order by observed_at DESC, id DESC. Within a same-observed_at group, id DESC returns the most recently inserted row - which, because chosen is inserted first, ends up being the worst-ranked duplicate row instead of the chosen one.

This already affects the auto-add dry-run summary path today: dotproject/auto_add.go (applyObservationToCandidate, called from lines ~756 and ~776) consumes whichever row these getters return, so the dry-run report can describe the wrong LFX profile for a maintainer with duplicate profiles.

It would also undermine #159 (fill-only chosen promotion) once that is implemented, unless this is fixed first or the promotion uses a different query.

## Suggested direction

Add an explicit tiebreak on match status (chosen before duplicate/others) ahead of id, or order by id ASC within an observed_at tie so insertion order (rank order) is preserved. Add a test with two rows sharing one observed_at.

## Origin

Surfaced during PR #157 post-merge issue triage, while verifying #159.