fix(linear): restore OAuth auth for idempotent issue create

[cursor]

Summary

• fix createIssueSingleAttempt to set Authorization via authHeader() instead of using APIKey directly
• ensure idempotent create requests use OAuth bearer tokens in client-credentials mode
• add regression coverage for CreateIssueIdempotent on OAuth clients

Bug and impact

Recent Linear batching/idempotency changes introduced a correctness bug in the idempotent create path: the single-attempt create mutation bypassed the normal auth header resolver and sent c.APIKey directly. In OAuth mode, APIKey is empty, so create requests returned 401.

Concrete trigger:

1. Configure Linear via LINEAR_OAUTH_CLIENT_ID + LINEAR_OAUTH_CLIENT_SECRET (OAuth mode).
2. Trigger idempotent create path (CreateIssueIdempotent), e.g. duplicate-title creates in batch push.
3. createIssueSingleAttempt sends empty Authorization header.
4. Linear rejects create; issue push fails for affected items.

This is significant user-facing breakage for OAuth-backed sync workflows.

Validation

• Added TestCreateIssueIdempotent_UsesOAuthBearerForCreateMutation.
• Ran: CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear -count=1.
• Also ran make test (fails in this environment on existing Dolt-dependent tests due missing dolt binary, unrelated to this change).