fix: address RUSH-594 P0 audit issues

[muqsitnawaz]

Summary

• Fixes the RUSH-594 P0 code issues by writing config files with private permissions, moving issue filters and lookups to GraphQL variables, and pinning/checksum-verifying the installer download.
• Corrects the README P0 issues by reducing the badge wall, promoting manual install over pipe-to-shell, pinning install URLs, and removing repeated/stale size and supply-chain claims.

Key Evidence

• Config writes now create ~/.linear-cli with 0700 and config.json with 0600: linear:74, linear:75, linear:78, linear:83.
• Issue listing now passes IssueFilter through variables instead of interpolated query text: linear:876, linear:886, linear:893, with callers building dict filters at linear:1202 and linear:1347.
• Direct issue lookups now use $filter variables: linear:705, linear:711, linear:1422, linear:1442.
• Installer pins v0.13.0 and verifies SHA-256 before moving into place: install.sh:7, install.sh:8, install.sh:27, install.sh:47.
• README keeps only License/Python badges and demotes pipe-to-shell behind pinned manual install: README.md:5, README.md:6, README.md:24, README.md:31.

Verification

• python3 -m unittest -v -> 27 tests passed.
• python3 -m py_compile linear test_linear.py && ./linear --version && sh -n install.sh && git diff --check -> linear-cli 0.13.0, no errors.
• Isolated installer run: HOME=/tmp/linear-install-home-U3WcTL sh install.sh; installed /tmp/linear-install-home-U3WcTL/.local/bin/linear, linear-cli 0.13.0, SHA-256 d62ee380d5565e483f0750ded837b5d453fcc380ffab14fe1d34249d2079a1c2.

Linear: RUSH-594