feat(typescript): add knowledge-based Linear publication

[kmbroai]

Summary

Add optional organization-authored policy enrichment to direct Linear publication while preserving existing publication behavior when no knowledge base is supplied.

Changes

• Add repeatable --knowledge-base PATH support to publish scan, gated on a direct Linear API key.
• Preserve the existing severity-to-priority mapping when no knowledge base is supplied.
• With a knowledge base, apply only explicit policy rules to native Linear priority and existing labels; unmatched findings leave both unset.
• Resolve the exact Linear team and project, load the existing label catalog, and validate complete structured enrichment before the first mutation.
• Run one ephemeral, read-only Codex enrichment turn with Linear credentials removed and network access, search, local tools, configured integrations, user configuration, rules, project instructions, skills, and session persistence disabled.
• Carry resolved metadata through dry runs, direct issue creation, interruption handoffs, and private receipts without storing policy contents, paths, prompts, or credentials.
• Keep connected-app publication and recovery behavior unchanged.

Testing

• pnpm run format
• pnpm run types
• pnpm run build
• 144 focused Bun tests across enrichment, publication, CLI, Linear validation, and existing connected-app events
• npm tarball creation completed successfully
• native isolated-home regression verifies zero request tools, no Linear credential exposure, disabled ambient integrations and instructions, and no persisted policy or finding prompt
• three-pass high-risk prepublish review plus independent verification completed with no findings

The randomized full suite and installed-package smoke were attempted, but this shared checkout is rejected by the existing trusted-owner guard on its /tmp ancestry; the environment also lacks bubblewrap namespace support. The focused feature suites pass.

Risk and rollout

The feature is additive and requires both normal Codex authentication and a direct Linear API key. Existing publication behavior is unchanged unless knowledgeBasePaths or --knowledge-base is supplied. Enrichment and destination validation fail before issue creation.

Policies can select only native priority and labels that already exist in the selected Linear team or workspace. They cannot change routing, issue content, assignee, state, cycle, estimate, or due date.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.