Link merged GitLab MRs back to Linear issues

Build me a deterministic code workflow that closes the loop between GitLab merge requests and Linear issues. Every step is pattern-match, lookup, and CRUD across two systems, so no reasoning is needed.

Trigger: a GitLab webhook subscribed to the merge_request event, filtered down to the merged action only. Ignore opened, updated, approved, and closed-without-merge events.

Steps:

1. Use GitLab Get a Single Merge Request to fetch the MR by its project_id and iid from the webhook payload. Pull title, description, source_branch, web_url, merged_at, and the author.

2. Run a regex against the title, description, and source_branch to extract Linear issue keys that match the team-key pattern, for example [A-Z][A-Z0-9_]+-\d+. Make this configurable: accept either an explicit allow-list of team prefixes (ENG, OPS, DESIGN) or fall back to matching any uppercase prefix. Uppercase and deduplicate the extracted keys.

3. For each extracted key, call Linear Search Issues with the key as the query to confirm the issue exists and resolve it to a Linear issue id. Skip any key that does not resolve.

4. For each confirmed Linear issue, call Linear Add Comment to Issue with a markdown body like: 'Shipped in [<MR title>](<MR web_url>) at <merged_at>'. Include the author handle when available.

5. For each confirmed Linear issue, call Linear Add Link to Issue passing the MR web_url as the url and the MR title as the link title, so the MR shows up as an attachment in the Linear issue sidebar.

If no Linear issue keys are found, or none resolve, exit cleanly without posting anything. Be idempotent across re-deliveries of the same merge webhook: it is fine for Linear to dedupe attachments by URL, but the comment step should check existing comments on the issue for the same MR web_url before posting, to avoid duplicate shipped-in comments if GitLab redelivers the webhook.

Inputs the workflow should expose: the list of Linear team-key prefixes to match, the comment template string, and an optional allow-list of GitLab project paths so the workflow can be scoped to specific repos.