fix: restore OAuth auth in idempotent Linear issue creation

[cursor]

Summary

• fix createIssueSingleAttempt to use authHeader() instead of raw APIKey
• this restores OAuth bearer-token auth for CreateIssueIdempotent / create paths that use single-attempt mutation logic
• add regression test covering OAuth idempotent create flow and asserting bearer auth is sent on both search and create requests

Bug

OAuth-only Linear sync/create flows could fail all creates when idempotent create was used, causing major user-facing breakage (401 on create operations).

Validation

• go test -tags gms_pure_go ./internal/linear -run 'TestCreateIssueIdempotentOAuthUsesBearerHeader|TestCreateIssueEmbedsMarker|TestCreateIssueIdempotentRecoverAfterAmbiguousFailure'
• go test -tags gms_pure_go ./internal/linear
• make test (fails in this environment due to missing dolt binary in unrelated internal/storage/dolt test)