feat(webhooks): add linear verification scheme

[kai-jmi]

What

Adds a linear webhook verification scheme, alongside the existing github, slack, stripe and generic hmac-sha256 schemes.

Linear signs the raw request body with HMAC-SHA256 using the webhook signing secret and sends the hex digest in the linear-signature header, with a webhookTimestamp (ms epoch) embedded in the signed payload for replay protection. The generic hmac-sha256 scheme cannot verify these deliveries because it reads x-signature, so Linear webhooks currently cannot be verified at all.

How

• src/webhooks/verifiers.ts: new linear verifier. Constant-time signature check over the raw body; when the signed payload carries a numeric webhookTimestamp, deliveries outside a one-minute window are rejected (Linear's documented recommendation). Payloads without a parseable timestamp pass on signature alone. Dedup key is the signed body hash, consistent with the other schemes (the linear-delivery header is unsigned, so a replay with a fresh id still dedups).
• src/types.ts: "linear" added to the scheme union. WEBHOOK_SCHEMES derives from the verifier map, so API validation picks it up automatically.
• plugins/web-ui/src/webhooks.ts: Linear entry in the scheme selector with guidance text.

Verified

• node --test test/webhook-verifiers.test.ts: 14 pass (3 new: valid/forged signature, stale vs absent webhookTimestamp, dedup on signed body ignoring linear-delivery).
• tsc --noEmit on the root and the web-ui plugin: no new errors.
• eslint + oxlint on the touched files: clean.

The web-ui change adds one entry to the existing data-driven scheme list; markup and styles are untouched, so it renders identically to the four existing entries. No screenshot for that reason.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}