Add Linear read-only MCP module with optional Coder authentication

[tpetr]

Add a reusable linear-mcp module that installs a read-only MCP stdio adapter backed by the workspace owner's Coder external-auth token. The calling template supplies agent_id and an optional external_auth_id, then registers the exported launcher command in its MCP clients.

When Linear is not linked, the MCP still initializes and responds to ping, with an empty tool list and no authentication error output. It checks authentication every 30 seconds and sends a tool-list change notification when the account is linked or unlinked. Clients that cache tools may need a reconnect. Stale calls return a normal tool error explaining how to link the account.

The adapter uses the official MCP SDK and Linear's fixed /mcp/readonly endpoint. It retrieves fresh credentials from Coder per upstream request, rejects redirects, and keeps tokens out of files, Terraform values, client configuration, and process arguments. The installer provisions user-local Node 24 through standalone pnpm and uses a checked-in frozen dependency graph with lifecycle scripts disabled. OAuth application configuration and client registration remain the calling template's responsibility.

Validation:

• Six adapter tests pass, including skipped auth over real stdio, linking/unlinking without reconnecting, token rotation, rejected credentials, and sanitized upstream failures.
• Three mock-provider Terraform tests pass; formatting and validation pass.
• Fresh and repeated installation pass in a temporary directory.
• Installed launcher successfully initializes against the official read-only endpoint and discovers 43 tools.
• CI runs adapter and Terraform tests.

Publication review: changes contain generic code, public dependency metadata, and fake test credentials. No OAuth credentials or internal deployment configuration are included.