Fix Cur session discovery and external-config imports

[shiny-code-bot]

Objective

Fix Cur session discovery for hyphenated/multi-segment project paths and restore dependent external-agent configuration imports.

Finish Line

Cur transcripts are discovered, grouped, filtered, and re-detected correctly under release-runner paths such as codex-ci-tmp; subagent transcripts remain excluded; app-server secondary-source import sees the expected session and plugin state.

Current Status

• PR Fix bounded Cursor project path decoding #728 is open from code/issue-710-cur-discovery on final head de9b74bd89 (two commits based on main@2b01436458654e54fd265eb2e08463fc26f0720f).
• Root cause confirmed: the bounded resolver could repair only one terminal suffix or one adjacent ancestor pair, so it could not compose multiple hyphenated path components such as Developer-Artifacts/.../codex-lab/.../issue-710.
• The fix uses composable filesystem-guided decoding with deterministic sorted enumeration, a global 4,096-entry scan cap, a 128 matching-path probe cap, fail-closed read/cap errors, unsafe-encoding rejection, exact and normalized ambiguity detection, Windows ASCII case-insensitive matching, and lazy cwd decode after transcript discovery.
• Validation is green: 28/28 Cur-focused tests, including new multi-hyphen, unsafe-input, bound, and Windows mixed-case coverage; the dependent app-server secondary-source import passes 1/1; scoped Clippy/fix, formatting, and diff checks pass.
• Opus approves the final state. GPT records one non-blocking residual around full Windows Unicode/per-directory case semantics beyond the ASCII regression covered here. JetBrains inspection is environment-blocked (UNKNOWN, retry disabled); Gemini/Antigravity is unavailable and not treated as approval.
• Next action: babysit Fix bounded Cursor project path decoding #728 through CI/review and merge, then close Fix Cur session discovery and external-config imports #710 and reclassify the remaining release map from the new immutable main SHA.

Acceptance Criteria

• Resolve common separators and multi-hyphen path components without unbounded candidate generation.
• Preserve ambiguity safeguards and subagent-transcript exclusion.
• Batch detection and modified-import re-detection remain correct.
• The dependent app-server secondary-source import passes end-to-end.
• Focused migration and app-server tests pass on macOS-like temporary paths.

Relationships

• Sub-issue of Restore lab.5 release Rust test convergence #703.
• Failure source: validation-only release run 31973347222.