#3683 feat(trace): add the Cursor harness to the end-to-end suite

Adds a Cursor harness to the Chainloop Trace end-to-end suite. This is part of milestone 3 of spec issue-3635 (R-003, R-004, R-011). It refs #3635.

• e2e/cursor.go runs the Cursor CLI (cursor-agent -p --output-format stream-json --force --trust). HOME is a folder next to the workspace, so the Cursor configuration and hooks of the user do not load. The Trace hooks read the transcripts from the same folder. The CLI then has no stored login, so a run needs CURSOR_API_KEY.
• Cursor runs its shell tool in a login shell. On macOS, path_helper puts /usr/local/bin first in PATH, so the git hooks ran an installed chainloop, not the CLI under test. The harness writes shell startup files in its HOME that set PATH back.
• A result event with is_error fails the run, also when the process exits with status 0.
• DisableSessionStart removes the sessionStart entry from .cursor/hooks.json.
• The headless Cursor CLI cannot attach a pasted image, so a scenario with images is an error. The pasted image cell of Cursor is No, so the suite skips that scenario.
• The Cursor output does not show the hook messages, so the hook message checks are "not covered" (R-004).
• The suite config pins Cursor 2026.10.19-6bbf2c4 with the auto model, which is the only model of a free plan. In auto mode no output names the model, so the model name check is "not covered" for an auto session.
• The Cursor cells of the feature tables come from a suite run: hook installation and deletion, the Trace run wrapper, and the spec source role, title, and description are Yes. Media skipped by redaction stays Unknown: the Cursor transcript holds no tool outputs, but a pasted image stays inline in it, and the headless CLI cannot attach an image to check it. The Cursor CLI sends the shell hooks, so the "Cursor IDE only" notes are removed.

This PR was written with the help of Claude Code.