feat(intake): add signed Linear webhooks

[IYENTeam]

Summary

• add a signed POST /linear intake with exact raw-body HMAC verification, timestamp validation, bounded replay suppression, rate/concurrency controls, and fail-closed queue admission
• add closed-by-default Linear configuration, private-file enforcement, atomic 0600 saves, and credential-redacted config show
• preserve generic linear.<entity>-<action> events with full signed payload metadata and deterministic routing tests
• document production proxy requirements, status/replay semantics, deployment caveats, and localfile limitations
• add project-scoped Rust analyzer configuration for Codex and OpenCode with Clippy checks

Verification

• cargo fmt --check
• cargo clippy --all-targets --all-features
• cargo test — 765 unit tests plus all integration/doc tests passed
• cargo build --release
• git diff --check
• five-lane post-implementation review: goal, code quality, security, hands-on QA, and repository context all PASS
• hands-on PR-binary QA covered happy path, invalid/stale signatures, replay casing/future windows, 1 MiB body limit, delivery-header limit, body timeout/stream failure, rate limiting, replay-cache saturation, config permission rejection, and secret redaction
• live Mac mini E2E established https://op-pi.iyendev.com/linear; a real Linear issue create/remove reached the configured sink with no Linear delivery failures

Operational notes

• application body controls start after HTTP headers are parsed; production proxy requirements are documented in docs/linear-intake.md
• replay suppression is bounded and in-memory, not an exactly-once or persistent deduplication guarantee
• deployment configuration and signing secrets are intentionally excluded from this PR

[IYENTeam]

Intake review completed against head 625882f410c8922c94bfe6c338b380b88f0ed43a.

Tracking issue: #20

Verified

• CI: Build, Check, Clippy, Format, and Test all passed.
• Independent local checkout: cargo test passed (761 unit tests plus integration/doc suites; no failures).
• Signature verification, timestamp boundaries, queue-failure retry, bounded replay state, body limits/timeouts, rate limiting, private config permissions, and credential redaction have direct test coverage.

Merge blockers / owner gates

1. Unrelated diff: .codex/lsp-client.json and .opencode/lsp.json configure editor/agent LSP behavior and are outside the signed Linear intake contract. Please split them into a separate PR or obtain explicit approval for the expanded scope.
2. Public/config/runtime contract: the new endpoint, [linear] config, response semantics, event naming, and config show redaction are contract changes and require owner approval before merge. (CHANGELOG.md does document the redaction behavior.)
3. External-integration evidence: the PR states a real Linear issue create/remove reached the sink, but no independently inspectable receipt/log or reproduction record is attached. Please record a sanitized acceptance/sink-delivery receipt and one fail-closed rejection, or obtain owner judgment accepting the current claim.
4. Size gate: this PR is 1,444 additions / 40 deletions, so owner review is required regardless of CI status.

No merge was performed.