Add Linear project triggers

[boudra]

Paseo Hub can connect a Linear app and run workflows from signed Linear issue, assignment, and comment events. Workflows can reply into Linear while keeping repository authority explicit per step.

Goals

• Connect Linear workspaces through app OAuth with rotating-token refresh.
• Verify, deduplicate, persist, and route signed Linear webhooks.
• Trigger workflows from comments, assignments, and issues entering an explicit project scope.
• Filter by connection, project, state, labels, assignee, allowlisted actors, text, and parsed inputs.
• Materialize bounded causal issue history only when execution context is built.
• Expose Linear setup, connection health, activity summaries, and configuration contracts in the operator surfaces.
• Keep repository access explicit; a Linear connection never grants GitHub authority.

Non-goals

• Native Linear Agent Sessions. That lifecycle will be evaluated separately with real-install QA.
• Automatic repository selection or implicit code-host authority.
• Compatibility shims for pre-release Linear configuration shapes.

Why

The core Linear workflow has been exercised against a real workspace, including OAuth, genuine signed webhooks, trigger routing, app-authored replies, loop prevention, and adversarial signature cases. Native Agent Sessions were added later with a separate lifecycle and no real-install evidence, so this PR deliberately keeps the proven core integration and leaves that surface for a focused follow-up.

Attribution

This branch preserves Michael Wu's original commits and authorship from PR #59. The maintainer-owned rebase and scope reduction are layered on top; both contributors remain represented in the commit history.

Supersedes

• PR #59 — Add Linear project triggers — This PR carries forward its core Linear workflow, rebases it onto current main, and removes native Agent Sessions from the scope.

Related work

• Public documentation PR #3963 — Companion Linear setup and trigger documentation; Agent Session material remains out of scope here.

Verification

• npm run typecheck
• npm run format
• npm run lint
• npm run build
• 72 focused Linear provider, event, matching, webhook, reply, and runtime tests
• Desktop Chromium Apps spec: 6 embedded-mode journeys passed; 16 PostgreSQL-backed journeys could not start because this environment has no container runtime
• Earlier real-workspace verification: OAuth, signed webhook intake, routing, app-authored reply, loop prevention, and adversarial signature cases

Risk surface

Review OAuth rebind and rotating-token serialization, signed webhook freshness and replay deduplication, connection/project isolation, issue-scope edge detection, and the new database migration. The browser setup journey and responsive operator UI are the principal integration surfaces.