Linear API keys are not recognized by the shared error redactor

Summary

safeErrorMessage() does not recognize the Linear API-key prefix used by the SDK's Linear integration.

The shared redactor currently detects several credential forms by prefix:

/(?:\b(?:sk-(?:proj-)?|github_pat_|gh[pousr]_|npm_)\S+|...)/

but not lin_api_.

The repository itself uses lin_api_... fixtures for Linear credentials. As a result:

safeErrorMessage(new Error("Linear failed for lin_api_SYNTHETIC_SECRET"))

returns the original message rather than [redacted].

Why this matters

The Linear integration uses safeErrorMessage() on publication failures before those errors can be written to the durable publication handoff/result path. linear.ts separately compensates for this gap by checking whether a generic request error contains the exact active credential, but the direct publication path relies on the shared redactor alone.

The redactor's documented contract is to omit credential-bearing messages at persistence and display boundaries, so a supported credential prefix should be covered centrally rather than requiring each caller to know the active secret value.

Expected behavior

Treat a lin_api_ token like the other known credential prefixes and redact the complete message.

Suggested fix

Add lin_api_ to the known-prefix branch in safeErrorMessage() and extend the existing redaction regression table with a synthetic Linear API key.

Start at safeErrorMessage() and its existing redaction regression table, then review linear.ts to understand the separate credential check. Add coverage for a synthetic lin_api_ credential and verify that the complete error message becomes [redacted]. Run the existing redaction tests to confirm other credential prefixes still behave as before.