feat(executor): add Cursor CLI as a full-parity task executor

[bborn]

Summary

Adds Cursor Agent CLI (agent / cursor-agent) as a first-class TaskYou executor at grok-level parity.

• Launch interactive Cursor in tmux with the usual worktree env (WORKTREE_TASK_ID, WORKTREE_PATH, …)
• Session resume via --resume <chat-id>; chats discovered under ~/.cursor/chats/<md5(cwd)>/<id>/
• Dangerous mode maps to --force (overridable with CURSOR_DANGEROUS_ARGS); Cursor has no Claude-style --permission-mode
• Per-task --model (multi-vendor prefixes: gpt-, composer-, claude-, grok-, …)
• Always pass --approve-mcps; merge ty mcp-server --task-id into <worktree>/.cursor/mcp.json
• Write-guard via <worktree>/.cursor/hooks.json (preToolUse + beforeShellExecution)
• Do not pass Cursor's --worktree flag — TaskYou already isolates each task
• Wired through CLI completions, TUI/GUI executor lists, auth-stuck detection, and docs

Test plan

• go test ./internal/db/ ./internal/executor/ ./cmd/task/ ./internal/ui/ ./internal/pipeline/ ./internal/web/
• golangci-lint run on changed Go packages
• Create a task with -e cursor (Cursor CLI installed) and confirm it launches in tmux
• Retry/resume a cursor task and confirm --resume is used
• Toggle dangerous mode and confirm --force appears
• Confirm .cursor/mcp.json contains the taskyou MCP server and .cursor/hooks.json wires worktree-guard --format cursor

[bborn]

QA evidence

VHS screenshots of the real ty binary from this branch, against an isolated QA DB (scripts/qa). Published to the public R2 evidence bucket (HTTP 200, image/png, fetched bytes match local).

New-task form — Cursor is a first-class executor

Type-to-select cu highlights cursor in the executor row (alongside claude, codex, gemini, grok, opencode, pi). This is the live TUI, not a mock.

CLI — --executor cursor and --model for cursor

ty create --help lists cursor in the executor flag and names it as a --model-capable backend.

Persistence — ty create -e cursor stores the slug

Task #23 created with --executor cursor; ty show --json returns "executor": "cursor".

What I actually drove

• Built /tmp/ty-qa/ty from this branch
• Seeded a realistic isolated board, then ty create … --executor cursor
• Shot the TUI form with VHS (ty-qa-shoot.sh) and CLI help/show with VHS
• Uploaded via scripts/qa/ty-qa-publish.sh 696
• curl -sI on each public URL: 200, Content-Type: image/png
• Re-fetched the form PNG; cmp matches the local capture

Not verified in this pass

• Live tmux launch of agent/cursor-agent against a real Cursor session (would spawn a worktree + billed agent)
• Resume / dangerous-mode toggle on a running Cursor pane