Add gated Cursor Agent support for agent notes

[itsjling]

What to build

Add Cursor Agent as an agent-note provider when the installed CLI can meet Diffsplain's review boundary. This follows the fail-closed work in #31; Cursor now offers Ask mode, a read-only sandbox, network policy, and tool permission controls that did not exist when that issue closed.

Run Cursor in a disposable workspace with non-interactive Ask mode, a read-only filesystem, no temporary writes, default-deny shell networking, and denies for shell, write, WebFetch, and MCP actions. Keep repository rules, skills, hooks, plugins, and MCP settings out of that workspace. Cursor may contact its own service, but review text must not gain host access through Cursor tools.

Enable explicit selection and the normal fallback order only after a hostile-input canary proves the boundary. Old or incompatible Cursor versions must fail closed before note generation starts.

Acceptance criteria

• A signed-in, compatible Cursor CLI can generate complete file and change notes with --agent cursor, including --model support and parsed structured output.
• Automatic provider selection tries Cursor after Copilot and before OpenCode only when Cursor passes the compatibility check.
• Cursor runs in non-interactive Ask mode inside a disposable, read-only workspace with temporary writes disabled and shell network access denied by default.
• Shell, write, WebFetch, and MCP actions are denied without relying on prompt text; force, yolo, and automatic MCP approval modes are never used.
• Repository-supplied Cursor rules, root agent instruction files, skills, hooks, plugins, and MCP settings are not loaded into the review run.
• A hostile snapshot canary proves Cursor cannot read host secrets, write files, run commands, reach local or external hosts through tools, or emit an unexpected tool call.
• Cursor stays disabled with a clear upgrade or boundary error when its version, flags, sandbox, permission policy, workspace trust behavior, or canary result is incompatible.
• doctor reports Cursor's real path, version, installed state, and compatibility instead of treating every Cursor install as absent.
• CLI help, provider fallback text, the root usage guide, product record, and product docs state the supported Cursor boundary and the fact that Cursor still contacts its service.
• Unit, integration, hostile-input, doctor, CLI contract, and documentation checks cover Cursor; the full lint, test, docs check, and repository check commands pass.

Blocked by

None - can start immediately