fix(test): defeat Linear API's transient "conflict on insert" flake

[flipbit03]

Problem

CI's Tests (Online) job had been flaking on *Create mutations for several PRs running. Linear's GraphQL API has structural consistency issues that aren't transient (despite looking like flakes): *Create mutations sometimes return "Entity X with id <UUID> already exists" for a UUID that doesn't actually exist server-side, soft-deleted resources accumulate as zombies counting against free-plan limits, and freshly-created resources may not be queryable for several seconds.

Same pattern hit PR #140's post-merge CI before the work in #141 even started — confirming the issue is structural, not introduced by recent work.

Approach

Treat Linear's quirks as the environment we're testing against, not bugs to wait out. Codify three mandatory pillars for every online test (added to CLAUDE.md) and retrofit the entire suite to follow them.

The three pillars

1. Proactive cleanup. Never assume the workspace is empty; never leak resources between tests.

• cleanup_workspace in lineark-test-utils had a real bug: it queried client.X().first(250).send() without include_archived(true), so soft-deleted projects/issues/documents from prior runs were silently invisible. We discovered 24 zombie teams + 10 stuck-in-trash projects accumulated this way. Fixed.
• Every test uses create_test_team() (calls cleanup_zombies() once per process + assigns a unique team key) and wraps every created resource in the matching RAII *Guard immediately after the create returns. Guards delete on drop so cleanup happens even when later asserts panic.
• The cleanup-test-workspace binary now iterates every pooled workspace (not just the random one it draws), so any workspace silently accumulating zombies because it kept losing the random draw still gets tidied.

2. Unique names per attempt. Linear's API returns phantom "conflict on insert" errors keyed on request body content, so retries with identical bodies hit the same sticky conflict.

• Generate a per-test random suffix: format!("[test] <what> {}", &uuid::Uuid::new_v4().to_string()[..8]).
• 6 SDK tests had hardcoded titles like "[test] SDK issue_create_and_delete" — no UUID suffix. Two test runs would collide. Added suffixes.
• run_lineark_with_retry mutates the <name> positional between attempts (appends retry-<uuid6>) so each retry sends a different body. Mutation is gated on [test] prefix so comments create <uuid> and relations create <uuid> (which take UUID positionals) aren't corrupted.
• Returns (Output, String) so callers can shadow their unique_name with the actually-used name for downstream read-by-name lookups.

3. Retries on every transient-capable call.

• 32 CLI tests + the create_two_issues helper called lineark <resource> create directly via lineark().args(...).output(), bypassing run_lineark_with_retry. Converted all 30+ sites.
• run_lineark_with_retry bumped to 15 attempts with [0, 2, 5, 10, 20, 30, 60×9]s backoffs (~9 min worst case) — persistent enough to ride out Linear's cold window without needing a suite-level wrapper.
• retry_create in lineark-test-utils (used by SDK tests) bumped from 3 → 15 attempts to match.
• Suite-level retry removed. The previous version wrapped the whole online suite in a 3x retry — wasteful (re-ran 60+ passing tests because 1 failed) and counter-productive (suite-level retries are no longer needed when per-call retries are persistent). Replaced with single-shot suite invocation.
• continue-on-error: true from an earlier emergency patch is also gone.

Multi-workspace token rotation

~/.linear_api_token_test and the LINEAR_TEST_TOKEN GitHub secret now accept a ;-separated pool of API tokens — one per workspace. test_token() picks one at random per test process and pins it for the process lifetime via OnceLock. Across runs the load distributes ~uniformly across N workspaces, spreading pressure on Linear's free-plan resource limits and trash-retention quirks.

Format details (with unit tests):

• ; is the primary separator; newlines also work.
• Trailing ; is harmless; #-prefixed comment lines are dropped.
• Comment filtering happens before ;-splitting, so a ; inside a comment doesn't accidentally produce fake "tokens".
• Single-line single-token files (the original format) work unchanged.
• test_token() logs using workspace N/total (token …<last6>) at process start so a CI-failure triage can instantly identify which workspace was hit.

This PR ships configured with 3 fresh workspaces (cadu-test-2/3/4). The previous workspace (cadus-test-workspace) had 10 trashed projects stuck on Linear's 30-day retention cycle — Linear's API has no permanent-delete for projects, so we abandoned it for fresh workspaces with no stuck history.

Test plan

• cargo fmt && cargo clippy --workspace --all-targets -- -D warnings clean
• make test — 235 offline tests pass (this is test-only code; offline suite is unaffected by design)
• make test-online — 107 online tests pass locally (67 CLI + 40 SDK)
• CI all 8 checks green: Lint, Tests (Offline), Tests (Online), 5 Build targets
• CI logs show all 3 pooled workspaces being visited per run (cleanup hits all 3, test processes pick at random)
• No serde_json::Value::Null injection or hand-written mutation(...) strings remain under crates/lineark/src/commands/