feat: select issue states by name and allow listed relations

[OmerFarukOruc]

Guarded writes now pick a workflow state by exact name. They can also relate two same-team issues in projects the caller lists. State and relation writes fail closed on Target Mismatch. They read the result back before reporting success. Ambiguous writes read observed state and do not replay.

Refs: https://linear.app/linctl/issue/LIT-171/support-hive-coding-job-workflow-states-and-cross-project-relations

Why

Hive coding jobs need a named started state such as In Review. A type-only pick can land on the wrong started state. They also need a related link across two named projects on the same team, without moving either issue.

Important changes

• --state on create and update matches an exact team state name first, then a type.
• After every state write, the issue is read back. A mismatch returns STATE_MISMATCH.
• issue relate --allowed-project names every project those issues may occupy.
• A project outside that list is Target Mismatch before mutation.
• A cross-organization pair returns CROSS_ORGANIZATION_RELATION before mutation.
• Success returns both issues and the relation after a follow-up read.
• issueRelationCreate and state assignment are reconcile-before-retry. Linear has no stable idempotency key unless the caller supplies IssueRelationCreateInput.id.

Safety

The Target Mismatch hard stop is unchanged. No bypass flag. No implicit project widening. One organization, one team, and explicit allowed projects remain the relation boundary.

• Reads stay free; any new write is target-pinned and fails closed on mismatch (no bypass flag)
• Operations are schema-aligned (genqlient); internal/client/internal/gql/generated.go regenerated and committed
• No token value is printed or logged

Documentation

• Hive Linear docs mirror, scrape 19-08-2026, scraper SHA e8ec39d: teams/configuring-workflows.md (several started states on one team)
• issue-properties/issue-relations.md (related, blocks, duplicate)
• Vendored internal/client/schema.graphql: WorkflowState, IssueUpdateInput.stateId, IssueRelationCreateInput (optional UUID v4 id)
• Linear SDK pin .linear-sdk-ref a3480b14b31a0d92447224143ececa7698ac0625
• https://linear.app/developers/graphql

Observed checks

Candidate SHA df8bc5811f87c6d3d189f7d5d0cb2c6110372733 on worktree .slim/worktrees/lit-171, 21-08-2026.

• go tool task ci: pass, exit 0
• go tool task coverage: 100.0% hand-written statements, no zero-count block
• git diff --check: clean
• Integration and live write tests: not run. This packet is read-only on Linear. No disposable write fixture ran in this session.

Independent Matt review, then thermo review, should run on this SHA. This session does not approve the candidate. Leave the pull request unmerged until Omer authorizes merge.