docs(adr-016): Linear attachments follow the Jira aws-samples#619 pattern, not confirm-uploads

Verified: PR aws-samples#619 (merged) already solved headless vendor attachments for Jira
by fetching them AUTHENTICATED at task-admission time in the webhook processor
(jira-attachments.ts) and injecting via create-task-core's preScreenedAttachments
seam — bypassing the confirm-uploads/Cognito flow entirely. Also verified the
confirm-uploads endpoint IS Cognito-only (task-api.ts:834), which is why the
presigned/large-file path is unavailable to webhook callers — but aws-samples#619 shows
that path is not needed.

So the fix is NOT adding HMAC auth to confirm-uploads; it's building the Linear
analog linear-attachments.ts (fetch uploads.linear.app + paperclip attachments
with the @bgagent ChannelCredential, screen via Bedrock Guardrail, inject as
preScreenedAttachments), mirroring aws-samples#619. P4 updated to reference aws-samples#619 as the
template and to note the confirm-uploads limitation is irrelevant to this path.
This confirms "remove Linear MCP, do attachments deterministically" — the
maintainer's short-term "use Linear MCP" note predates having aws-samples#619 to copy.

Author: isadeks

docs/decisions/ADR-016-pluggable-identity-and-auth.md

@@ -149,7 +149,7 @@ Per-user `McpCredential` selection requires the Gateway to know *which task-user
 | P1 | **`ChannelCredential` for Linear (deterministic path first).** Move the Lambda tier + agent `linear_reactions.py` off Secrets Manager onto the vault: one `abca-linear-channel` workload identity, credential keyed `linear-workspace:<id>`, the 6 Lambda roles + runtime role granted `GetResourceOauth2Token` on that domain. Deterministic ops stay direct GraphQL — only the token source changes. | Flag-gated; SM fallback retained until green; per-workspace isolation preserved. |
 | P2 | **Retire SM refresh/write-back** once P1 is green: drop `PutSecretValue` from the 5 Lambda roles and delete `tryRefreshOnce` write-back in `linear-oauth-resolver.ts`; the vault owns refresh. | No SM writes remain on the Linear path. |
 | P3 | **MCP control plane (registration + Gateway execution).** Build `McpRegistration`/`McpCredential`: users/workspaces register MCP servers + bind tools to agents/workflows; every registered MCP runs through the Gateway; unsupported auth fails closed; no direct-MCP fallback. | Registration API + Gateway execution; fail-closed verified. |
-| P4 | **Remove Linear MCP; make Linear fully deterministic.** Delete the `"linear"` MCP builder in `channel_mcp.py` (`_build_linear_entry`/`_linear_server_entry`); rewrite `prompt_builder.py` to drop all `mcp__linear-server__*` guidance and instead consume pre-hydrated context + rely on Lambda for writes. Pre-hydrate Linear issue text/comments in #176 `context-hydration.ts`; fetch `uploads.linear.app` attachments authenticated via `resolve-url-attachments.ts` + the `@bgagent` `ChannelCredential` bearer. Retire the per-thread `LINEAR_API_TOKEN` MCP env. | No `linear-server` MCP entry written; agent runs from hydrated context; attachments fetched authenticated; tests updated. |
+| P4 | **Remove Linear MCP; make Linear fully deterministic — mirror the Jira attachment pattern (PR #619).** #619 already solved the identical problem for Jira: because the vendor MCP can't run headlessly, attachments + recent comments are fetched **authenticated at task-admission time in the webhook processor** (`jira-attachments.ts` → `api.atlassian.com/.../attachment/content/{id}` with the 3LO token, refresh-retry on 401/403, magic-bytes + Bedrock-Guardrail screen, S3 upload) and injected via `create-task-core.ts`'s `preScreenedAttachments` seam — **bypassing `confirm-uploads`/Cognito entirely.** Build the Linear analog `linear-attachments.ts`: fetch `uploads.linear.app` + paperclip attachments with the `@bgagent` `ChannelCredential`, screen, inject as `preScreenedAttachments`; pre-hydrate issue text/recent comments (mirroring #619's `fetchRecentHumanComments`). Then delete the `"linear"` MCP builder in `channel_mcp.py` (`_build_linear_entry`/`_linear_server_entry`), rewrite `prompt_builder.py` to drop all `mcp__linear-server__*` guidance (agent works from pre-hydrated context; Lambda owns writes), and retire the per-thread `LINEAR_API_TOKEN` MCP env. **NOTE the `confirm-uploads` Cognito-only limitation (task-api.ts:834, verified) is IRRELEVANT to this path** — #619 proves webhook-sourced attachments don't touch the presigned/`confirm-uploads` flow at all. | No `linear-server` MCP entry; agent runs from hydrated context; attachments fetched authenticated + screened (Jira #619 pattern); tests updated. Requires main merged in (for #619/#176 seams). |
 | P5 | **General MCP control plane (registration + Gateway execution)** — NOT Linear. Build `McpRegistration`/`McpCredential`: users/workspaces register arbitrary MCP servers + bind tools to agents/workflows; every registered MCP runs through the Gateway; unsupported auth fails closed; no direct-MCP fallback. | Registration API + Gateway execution; fail-closed verified. |
 | P6 | **Trusted task-user identity propagation** (prerequisite for per-user MCP on the general plane, P5): specify + validate a user-scoped inbound identity the Gateway authorizer trusts, replacing the M2M JWT for per-user credential selection. | **Blocks per-user `McpCredential`.** Until done, MCP credentials are workspace-scoped at best. |
 | P7 | Jira + Slack `ChannelCredential` (same shape as P1); GitHub `GithubOauth2` behind a flag, retire the shared PAT; OBO `act`-claim delegation feeding #237. | Flag-gated; per-surface. |