fix(ci): mark @cursor/sdk external in standalone-binary bundle step

[George-iam]

Why

The v0.6.0 tag push triggered release-binary.yml and the build matrix failed on all 6 platforms (failed run) with:

```
✘ [ERROR] Could not resolve "@anysphere/cursor-sdk-local-runtime/run-store"
node_modules/@cursor/sdk/dist/esm/public-api.d.ts:2:189
✘ [ERROR] Could not resolve "./messages.js"
✘ [ERROR] Could not resolve "./platform.js"
... (46 errors total)
```

Diagnosis

release-binary.yml does a second-pass esbuild on top of dist/cli.mjs to produce a single self-contained file per platform. In v0.6.0 we added @cursor/sdk as an optionalDependency for first-class Cursor IDE support (PR #129). Its TypeScript declarations re-export internal workspace paths (@anysphere/cursor-sdk-local-runtime/*, ./messages.js, ./platform.js, etc.) that don't exist as resolvable modules in the published package — they're build-internal references.

build.mjs already knows about this — the plugin variant marks @cursor/sdk external for the exact same reason (build.mjs:74). But the inline esbuild call in the release workflow doesn't pass that flag, so it walks the type re-exports and dies.

Fix

One-line workflow change: add --external:@cursor/sdk to the second-pass esbuild bundle call.

Effects:

• Standalone binary: @cursor/sdk is no longer bundled. The AgentSdk factory's dynamic await import(\"@cursor/sdk\") returns MODULE_NOT_FOUND and falls back to the Claude wrapper — exactly the path standalone-binary users (curl|bash install, not Cursor) actually need.
• Cursor extension (.vsix): unaffected — @cursor/sdk ships there via the extension's own bundling path. (Extension publish v0.1.5 succeeded on the same commit.)
• Plugin sync (AxmeAI/axme-code-plugin): unaffected — build.mjs already externalizes @cursor/sdk for the plugin variant.
• npm publish (@axme/code): unaffected — npm install resolves optionalDependencies independently; users who want Cursor SDK at runtime get it via npm install.

What needs to happen after this PR merges

The v0.6.0 tag has already been pushed and is bound to the broken commit. To re-fire the workflow against the fixed commit, the tag needs to be moved:

```bash

After this PR merges, from a fresh main checkout:

git checkout main && git pull origin main

Move v0.6.0 to the fixed commit

git push origin :refs/tags/v0.6.0 # delete remote tag
git tag -d v0.6.0 # delete local tag
git tag v0.6.0 # re-tag at current HEAD (has the fix)
git push origin v0.6.0 # fires release-binary workflow with the fix
```

The previous failed runs are harmless — no GitHub Release was created, no npm publish happened, no plugin-repo sync. The matrix failed before any external side effect, all downstream jobs (release / publish-npm / sync-plugin-repo) were skipped.

Test plan

• Workflow YAML syntactically valid (Edit succeeded, no shell errors)
• build.mjs already uses the same external: [\"@cursor/sdk\"] strategy for the plugin variant — pattern proven
• After merge + retag: workflow run succeeds end-to-end (6 binaries + GitHub Release + npm publish + plugin sync)

🤖 Generated with Claude Code