feat(server): wire the Linear agent-notification lane data sink (RIG-2732 T7)

[rigel-mintaka]

The Linear webhook ingress (POST /webhooks/linear, #744) landed with its
data-change sink injected-and-nil-for-now (DL-302): a verified Issue/Comment
event acked-and-dropped. This builds the Linear-provider-bound notify lane and
threads its sink into the handler, so a verified event now routes to
subscribers at the LINEAR/linear.app coordinate.

• buildLinearNotifyLane: the Linear sibling of buildForgeNotifyLane, gated
  App-INDEPENDENTLY on LINEAR_FORGE_TOKEN (forgeSecretDeclared) — the same
  credential the write path's Linear coordinate uses; undeclared -> nil lane
  (off-state), a resolve fault fails fast. Binds store.ForgeProviderLinear /
  "linear.app", client forge.NewLinear, reconciler Backstop 0 (-> ingest
  default).
• forgeNotifyChecksRoller generalized to hold a forge.NotifyReader instead of a
  concrete *forge.GitHub, so one adapter serves both lanes (both *forge.GitHub
  and *forge.Linear satisfy NotifyReader). Behavior-preserving for GitHub.
  Linear's ChecksConditional returns ErrUnsupported but the router invokes
  RollUp only on a CHECKS event Linear (issues-only) never produces.
• Serve builds the lane (same fail-fast cleanup path as the board wiring) and
  threads its sink through buildDoors (new linearDataSink param) into
  buildLinearWebhookWiring, replacing the nil sink. The two gates stay
  independent: the webhook secret gates the handler; LINEAR_FORGE_TOKEN gates
  the sink.
• startForgeIngestLanes now takes the notify lanes variadically; the Linear
  lane's arm + reconciler start on the serve errgroup. A nil lane starts
  nothing.
• The session arm (sessionSink) stays nil (RIG-2717's separate responder lane).

Refs RIG-2732

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2732

[github-actions]

Compass engineering docs preview: https://compass-forge-rig-2732-t7-li-da0p.compass-eng-docs.pages.dev

Deployed from compass-forge/rig-2732-t7-linear-notify at cb1bfa8.