fix(linear): honor oauth auth in idempotent create

[cursor]

Summary

• fix Linear idempotent single-attempt create to use authHeader() instead of hardcoding APIKey
• this preserves OAuth bearer authentication in CreateIssueIdempotent and duplicate-title single-create fallback paths
• add regression test proving OAuth-authenticated idempotent create sends a bearer token for both search and create requests

Bug and impact

When Linear is configured with OAuth client credentials, CreateIssueIdempotent could fail with unauthorized errors because createIssueSingleAttempt set Authorization to c.APIKey (empty in OAuth mode). This breaks issue creation paths that rely on idempotent single-create, causing sync/create failures for affected users.

Validation

• go test -tags gms_pure_go ./internal/linear
• make test (fails in this environment due unrelated pre-existing failures: TestTestServerConnection/unreachable_host and missing dolt binary for internal/storage/dolt tests)