Factory: paginate hosted PR closing-issue evidence

## Outcome

Ensure historical metrics publication can validate a recorded issue when an authoritative pull request has more than 100 closing-issue references.

## Context

Discovered during hosted review of #307 after the routine remediation cutoff. The current bounded GraphQL query reads the first 100 `closingIssuesReferences`. It fails closed when the recorded issue is outside that page, so this is independent availability hardening rather than a forged-publication risk.

## Acceptance criteria

- Create an OpenSpec-first bounded factory change from current `develop`.
- Paginate `closingIssuesReferences` with an explicit cursor and deterministic upper/resource bound.
- Preserve exact repository + issue matching and fail closed on malformed, cyclic, or over-bound pagination.
- Add positive multi-page, absent-link, wrong-repository, malformed-page, and bound-exhaustion tests.
- Keep GitHub responses and credentials out of public metrics/errors.

## Evidence

- Source PR: #307
- Review thread: https://github.com/hyperledger-identus/sdk-rust/pull/307#discussion_r4029693481

Start from the bounded GraphQL query for closingIssuesReferences and the factory path used for historical metrics publication, using current develop and source PR #307 for context. Add tests covering positive multi-page, absent-link, wrong-repository, malformed-page, and bound-exhaustion cases. Done means bounded cursor pagination preserves exact matching, fails closed safely, and exposes no GitHub responses or credentials.

Written by the indexing model from the issue text.