product-loop ingress
  POST /webhook  — Linear-Signature + replay verified, side effects gated
  GET  /install  — begin agent OAuth install
  GET  /callback — OAuth callback (stores the agent token)