fix(eve): expose Linear webhook timestamp skew

[vercel-gh-bot-5]

Linear retries preserve the original webhookTimestamp, but linearChannel always used the verifier's 60-second default. Delayed retries returned 401 even though verifyLinearRequest already supported a configurable window.

Hypothesis

Because the channel drops the existing maxSkewMs option, forwarding an opt-in value should accept intended retries without weakening the default replay protection.

Changes

• expose maxSkewMs on LinearChannelConfig and forward it to HMAC verification
• reject negative and non-finite values that could disable timestamp checks
• document the retry and custom-verifier security boundaries

Fixes #1570

Validation

• repro test returned 401 before the fix and 200 after it
• Linear channel unit tests: 31 passed
• eve typecheck passed
• focused lint, formatting, docs checks, changeset status, and invariant guards passed
• the full eve unit suite had one unrelated 5-second timeout in normalizeDevelopmentServerClientUrl; its isolated rerun passed

Requested by: colton.padden

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Aug 6, 2026 7:26pm
eve-docs-4759	Ready	Preview, v0	Aug 6, 2026 7:26pm