fix(linear): use OAuth auth header for idempotent creates

[cursor]

Summary

• fix createIssueSingleAttempt to use authHeader() instead of APIKey directly
• this restores OAuth client-credentials support in the idempotent create path
• add regression coverage in internal/linear/idempotency_test.go to assert bearer-token auth is used

Bug

CreateIssueIdempotent calls createIssueSingleAttempt, which was setting Authorization to c.APIKey. In OAuth mode, APIKey is empty, so idempotent issue creation could fail with unauthorized responses.

Validation

• CGO_ENABLED=1 go test -tags gms_pure_go ./internal/linear -run 'TestCreateIssue(Idempotent_OAuthUsesBearerToken|EmbedsMarker|Dedups|IdempotentRecoverAfterAmbiguousFailure)'
• make test (fails in this environment due unrelated pre-existing failures: TestTestServerConnection/unreachable_host and internal/storage/dolt tests needing dolt in PATH)