feat(provider): add experimental cursor provider

[aurokin]

Author Note: The intent of this PR is to add Cursor CLI support to Clawpatch. I spent time reading the Cursor CLI docs, probing the CLI behavior directly, reviewing the implementation as it was built, and dogfooding this build while reviewing the final PR with Clawpatch using both Codex and Cursor.

Summary

• add an experimental Cursor Agent CLI provider behind explicit opt-in gates
• run Cursor in headless JSON mode with prompt-over-stdin, --mode ask for read-only operations, and separate write-mode opt-in
• harden Cursor review output parsing, version/advisory checks, prompt evidence constraints, and validation against prompt-included file ranges
• include linked tests in review prompt context and keep fix prompts aligned with normalized evidence paths

Safety / Scope

• Cursor doctor is available by default
• map, review, fix, and revalidate require CLAWPATCH_CURSOR_EXPERIMENTAL=1
• fix additionally requires CLAWPATCH_CURSOR_ALLOW_WRITE=1
• default Cursor timeout is 300s; override via CLAWPATCH_CURSOR_TIMEOUT_MS or CLAWPATCH_PROVIDER_TIMEOUT_MS
• date-formatted Cursor CLI builds are allowed only when the local Cursor app semver can be verified

Verification

• pnpm test
• pnpm typecheck
• pnpm lint
• pnpm build
• pnpm format:check
• pnpm pack:smoke
• git diff --check
• dogfooded node dist/cli.js review --since main --provider codex
• dogfooded CLAWPATCH_CURSOR_EXPERIMENTAL=1 CLAWPATCH_PROVIDER_TIMEOUT_MS=600000 node dist/cli.js review --since main --provider cursor

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(provider): add experimental cursor provider This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.