docs: add Cursor Cloud environment setup notes

[rrama]

What

Adds a ## Cursor Cloud specific instructions section to AGENTS.md capturing durable, non-obvious setup notes for agents running in the Cursor Cloud Linux VM.

Why

The default toolchain/hosts don't work out of the box in the restricted-egress VM. These notes save future agents from re-discovering the workarounds.

Notes captured

• Pin GOTOOLCHAIN=go1.26.5 (bare go 1.26 + auto tries the blocked go.dev).
• Install golangci-lint@v2.10.1 via the Go module proxy into .bin/ (the golangci-lint.run installer host is blocked).
• make build/make lint/make test all pass except pkg/networking.Test_GetHTTPClient, which does a live GET to the blocked bare snyk.io — an environment limitation, not a code defect.

Verification

make build (ok), make lint (0 issues), make test (51/52 packages pass; only the network-gated test fails as documented).

  

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

Superseded by #669, which now carries the consolidated notes — including this branch's more precise diagnosis of Test_GetHTTPClient (the live GET https://www.snyk.io 301-redirects to the bare snyk.io apex). Closing to leave one cloud-setup PR per repo.