feat: record linear_workspace_id on project-mapping rows (enable workspace-scoped mapping cleanup) — follow-up to #306

Parent context: surfaced during PR #681 review by @isadeks (issue #306). **Needs maintainer `approved` before implementation (ADR-003).**

## Finding
`LinearProjectMappingTable` rows carry **no workspace identifier**. The only writer — `onboard-project` (`cli/src/commands/linear.ts:~1484`) — writes `linear_project_id`, `repo`, `label_filter`, optional `team_id`, `status`, `onboarded_at`, `updated_at`. So any attempt to delete a workspace's project mappings (e.g. during `bgagent linear remove-workspace`) cannot attribute rows to a workspace and matches nothing.

Because of this, PR #681 (`remove-workspace`) **removed** its mapping-cleanup path entirely (it was a provable no-op reported to the operator as success). This issue restores that capability the correct way.

## Scope
1. Record `linear_workspace_id` on `LinearProjectMappingTable` rows at **onboard time** (`onboard-project` writer).
2. Backfill or migration strategy for existing rows (they predate the field).
3. Once the field exists, re-add workspace-scoped mapping cleanup to `remove-workspace` (the DELETE handler `cdk/src/handlers/linear-remove-workspace.ts`): re-introduce the paginated mapping scan/delete filtered on `linear_workspace_id`, its `projectMappingTable.grantReadWriteData` grant, the `--keep-mappings` flag, and the longer Lambda timeout — all of which #681 removed as dead code.
4. Consider a GSI on `workspace_slug` (registry) / `linear_workspace_id` (mappings) to turn the recurring slug→row lookups into `Query` (also noted in #681 review N4).

## Fulfills
The `LinearProjectMappingTable` deletion acceptance criterion of #306 that PR #681 deferred.

Refs #306

Inizia da cli/src/commands/linear.ts intorno alla riga 1484 e cdk/src/handlers/linear-remove-workspace.ts, quindi esamina PR #681 e issue #306 per il comportamento differito. Definisci l’approccio di migrazione o backfill per le righe esistenti e conferma che onboard writer registri linear_workspace_id. Il lavoro è completato quando remove-workspace può eseguire la scansione ed eliminare solo i mapping del workspace selezionato, ripristinando il comportamento indicato per permessi, flag e timeout.

Scritto dal modello di indicizzazione a partire dal testo della issue.