feat: add Cursor Agent CLI managed entry

[Li-Sanze]

Summary

• One Cursor installation now supports both the IDE and local Agent CLI.
• The IDE keeps its user Plugin Always Rule. For plan, development, resume, and closeout requests, the CLI may select a top-level Skill that reads and reuses the same Rule, phase Skills, payload, and user Hooks.
• Ordinary questions do not have to enter this path. Support remains BASELINE_SUPPORTED, and Cloud Agent or identical behavior across models is not promised.

Why

The local Cursor CLI experiment proved that a root sopify Skill can route Sopify workflow requests, but the entry existed only under ~/.cursor, was not protected by the installer, and could be deleted by a later Cursor reinstall. This PR turns that probe into a supported installation surface without adding another target, launcher, project Rule, MCP, or runtime.

What changed

• Add bilingual Cursor-only CLI entry templates for plan, development, resume, and closeout requests.
• Install the root Skill at ~/.cursor/skills/sopify/SKILL.md through the existing cursor:<language> target.
• Compare root Skill content during reinstall, replace stale local entries, remove stale siblings through the existing managed-tree replacement, and keep repeated installs idempotent.
• Keep the Cursor-only entry outside the shared Codex, Claude, Qoder, and Copilot Skill tree.
• Add one scope-expansion checkpoint to the Cursor Plugin Rule for new user-level or system-level persistence or deletion.
• Rewrite the public copy around three user facts: one installation, request-based CLI selection, and explicit support boundaries.

Verification

• Full suite: 313 passed, 81 subtests passed.
• Documentation and installation contracts after the copy rewrite: 69 passed, 30 subtests passed.
• GitHub hard-gate command reproduced locally after the final copy-contract update: 100 passed, 4 subtests passed.
• Version consistency and git diff --check: passed.
• Repeated local cursor:zh-CN install: host and payload both skipped as current.
• Cursor Doctor installation checks: Plugin, payload, global Skill tree, and Hooks all pass.
• The installed zh-CN root Skill and Plugin README match their Cursor-only sources.
• Negative coverage proves Codex, Claude, and Qoder do not receive the Cursor-only root entry.

Independent Cursor review

• Local Skill review first rejected the read-order guard because it existed only in the body; the guard moved into the frontmatter description and the follow-up review accepted it.
• Product review then rejected a shared-tree implementation because it could leak the Cursor-specific entry into other hosts; the entry moved to Cursor-only templates, shared-tree golden hashes were restored, and focused negative coverage was added.
• Copy review rejected inconsistent public summaries that omitted development or closeout. README, workflow docs, and both landing pages now use the same four request types: plan, development, resume, and closeout.
• Final Cursor reviews accepted both the implementation and the rewritten user copy with no remaining findings.

Boundaries

• No new cursor-cli target or install flag.
• No launcher, project .cursor/rules, AGENTS.md, Custom Mode, MCP, runtime, state schema, or HostCapability expansion.
• cursor_ide_behavior and cursor_cli_behavior remain BLACK_BOX_NOT_VERIFIED; installation evidence is not presented as portable runtime certification.
• Cloud Agent, merge, release, and explicit Sopify finalize are outside this PR.

Plan and evidence

• .sopify/plan/20260828_cursor_agent_cli_entry/plan.md
• .sopify/plan/20260828_cursor_agent_cli_entry/receipts/verify_003.json