feat(publish): add direct Linear API publication and assignees

[kmbroai]

Summary

Add an opt-in direct Linear publication path using the official @linear/sdk, alongside the existing connected-app workflow, with optional projects, unassigned issues by default, and explicit assignee selection.

Changes

• Select direct publication through --linear-api-key or CODEX_SECURITY_LINEAR_API_KEY; retain the existing Codex and connected Linear app behavior when neither credential is supplied.
• Instantiate LinearClient directly in the existing publisher instead of maintaining a separate GraphQL client, SDK wrapper, or transport implementation.
• Leave issues unassigned by default and resolve --linear-assignee as either an email address or a Linear user ID when assignment is requested.
• Support team-only publication by omitting project identifiers when no project is selected.
• Preserve finding descriptions, batches of 20, sealed-scan validation, private recovery handoffs, SQLite associations, progress, cancellation recovery, partial results, and original error details.
• Pin @linear/sdk to 89.0.0 and update its package lockfile.

Testing

• 99 focused CLI, publisher, and publication-event tests passed with 868 assertions.
• Seven direct-publication regressions cover credential selection, unassigned-by-default behavior, email/user-ID overrides, optional projects, partial batches, cancellation recovery, CLI validation, and real SQLite persistence.
• TypeScript compilation, formatting, and a freshly built npm tarball passed; the built CLI exposes --linear-api-key and --linear-assignee.
• Hosted CI runs the real sealed-scan SQLite integration and installed-package dry-run smoke on Linux, macOS, and Windows.

Risk and rollout

Direct Linear API publication remains opt-in. The official SDK owns GraphQL transport and authenticated requests, while existing publication storage and recovery code remains the source of truth for durable issue mappings.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.