fix(linear): prevent OAuth create failures and batch duplicate creates

[cursor]

Summary

This fixes two high-severity correctness bugs in Linear sync paths introduced by recent batch/idempotency work:

1. OAuth idempotent create breakage

   • createIssueSingleAttempt set Authorization directly from c.APIKey, which is empty for OAuth clients.
   • Any CreateIssueIdempotent path in OAuth mode failed with unauthorized API calls.

2. Duplicate issue creation in batch create reruns

   • BatchCreateIssues only used idempotency markers for post-failure recovery.
   • On reruns after a prior successful create with missing local external_ref persistence, the same issue could be created again because pre-create marker checks were missing.

Fixes

• Switched createIssueSingleAttempt to use authHeader() so OAuth and API-key auth are both correct.
• Added marker pre-checks in BatchCreateIssues before each batch mutation:
  • reuse existing issues when markers already exist,
  • submit only unresolved inputs,
  • keep ambiguous-failure recovery on unresolved inputs only.
• Updated/added regression tests:
  • TestCreateIssueIdempotentOAuthUsesBearerHeader
  • TestBatchCreateIssues_PrecheckSkipsExistingMarkers
  • adjusted existing marker-search/mapping tests to reflect pre-check + recovery flow.

Validation

• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear -count=1 -run 'TestCreateIssueIdempotentOAuthUsesBearerHeader|TestBatchCreateIssues_PrecheckSkipsExistingMarkers|TestBatchCreateIssues_AmbiguousFailureSearchesMarkers|TestBatchPush_AmbiguousBatchFailureSearchesMarkers|TestBatchPush_BatchCreateMappingByTitle'
• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear

(Full make test in this environment also reports unrelated pre-existing failures outside internal/linear, including cmd/bd and internal/storage/dolt.)