fix(linear): use OAuth auth header in idempotent single-create path

[cursor]

Summary

• fix createIssueSingleAttempt to use authHeader() instead of reading c.APIKey directly
• this preserves Bearer token auth for OAuth client-credentials mode in idempotent create flows
• add regression coverage for CreateIssueIdempotent in OAuth mode, asserting both the idempotency search and issueCreate mutation use Authorization: Bearer <token>

Bug / impact

In OAuth mode, idempotent creates could send an empty Authorization header on the single-attempt mutation path, causing 401s and failed issue creation in Linear.

Validation

• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear
• make test (fails in unrelated pre-existing tests in this environment: cmd/bd TestTestServerConnection/unreachable_host and internal/storage/dolt TestPullWithAutoResolve_BranchTrackingFallbackSuccess due missing dolt binary)