feat(notion): CLI integration — REST client, ask agent, MCP tools

[rafeegnash]

Summary

• Adds internal/notion/ (client, pages, databases, blocks, markdown, users, conversation, status, static_commands) mirroring the Sentry/Linear shape
• clanker notion {ask, list, get, search, page, db} for natural-language and direct ops
• 10 MCP tools registered alongside existing providers (6 read + 4 destructive — create_page, append_blocks, update_page_properties, create_database_row)
• Surfaces Notion's share-with-integration gotcha in the ask prompt and empty-state copy — tokens start with zero access, this is the feat: discover, compliance flags and more aws services #1 papercut

Notes

• Auth: Authorization: Bearer <token> + Notion-Version: 2022-06-28 (opposite of Linear, which uses the raw key)
• Bounded block fetch (depth ≤ 3, total ≤ 200 blocks) to keep get blocks predictable against the 3 req/sec rate limit
• 429 backoff honors Retry-After, capped at 30s; network-retry uses exponential backoff
• Minimal markdown→blocks converter (paragraphs, headings, lists, todos, code fences, quotes, dividers) — round-trips back via BlocksToMarkdown
• Status snapshot derives page/db counts from a single /search call instead of three round-trips
• Config: notion.integration_token + optional notion.default_database_id; env fallback NOTION_API_KEY / NOTION_DATABASE_ID
• History at ~/.clanker/notion-{workspace}.json

Test plan

• go test -race ./internal/notion/... — happy path, 429 with Retry-After, share-failure empty results, auth-error envelope extraction, conversation round-trip, markdown→blocks fidelity, safeSlug path-traversal defense
• go build ./... clean
• clanker notion --help renders subcommand tree
• End-to-end with real token: clanker notion search "runbook", clanker notion page append --page <id> --text "## test", clanker notion ask "what databases do we have?"
• MCP smoke test: clanker mcp --transport stdio exposes clanker_notion_* tools