fix(linear): restore OAuth auth in idempotent create helper

[cursor]

Summary

• fix createIssueSingleAttempt to build the Authorization header via authHeader() instead of reading APIKey directly
• this restores OAuth client-credentials compatibility for CreateIssueIdempotent call paths
• add regression coverage in TestCreateIssueIdempotentOAuthUsesBearerHeader

Critical bug and impact

In OAuth-configured environments (LINEAR_OAUTH_CLIENT_ID/LINEAR_OAUTH_CLIENT_SECRET), idempotent issue creation sent an empty/non-bearer auth header on the single-attempt mutation path. This caused deterministic 401 failures for affected create flows (notably duplicate-title single-create fallback during batch push), preventing issue creation and breaking sync/push behavior.

Validation

• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear -run '^TestCreateIssueIdempotentOAuthUsesBearerHeader$'
• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear -run '^TestCreateIssueIdempotent'
• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear/...

(Repo-wide make test has unrelated environment failures in this run, including missing dolt binary in unrelated packages.)