Merge main into feat/cursor-marketplace-native

#35 restored the Cursor overlay so the listing shape would conform. Keep the overlay deleted: Cursor is a root host. Keep listing version 1.0.0, take the public-boundary README wording, and drop the duplicate overlay validator.

Author: ericjuta

plugins/ask-gina/README.md

@@ -28,10 +28,7 @@ Scope: `tools:read` only. This plugin does not include transaction execution or
 
 Grok Bot loads plugins only from the Cursor marketplace. A local `~/.cursor/plugins/local` install proves the Cursor IDE loader, not Grok Bot.
 
-OAuth callbacks the Gina authorization server must allow:
-
-- `https://www.cursor.com/agents/mcp/oauth/callback` (Cursor / Grok Bot web)
-- `http://localhost:8787/callback` (desktop)
+The Gina authorization server allows the Cursor and Grok Bot web callback, `https://www.cursor.com/agents/mcp/oauth/callback`, and the Cursor desktop loopback callback.
 
 ### What it can do