feat(bin): add Cursor harness adapter support

[vipentti]

Overview

This PR adds first-class Cursor agent harness support to firstmate. Cursor becomes a verified adapter for crewmate and secondmate work: firstmate detects trusted Cursor processes and resolves installed executables, spawns agents, participates in session locking, supports tmux and Herdr endpoints, checks remote readiness and liveness, and safely contains and reaps detached worker-server processes.

It also adds tracked Cursor stop and preToolUse hooks with turn-end supervision, extends composer, ghost-text, busy-queue, and submission handling for Cursor's TUI, and documents and tests the behavior. This matters because Cursor's process identity, composer, hook protocol, and detached worker-server differ from existing harnesses; explicit adapter support lets firstmate supervise and clean up Cursor workers with fail-closed lifecycle behavior across local and remote work.

The adapter scope covers crewmate and secondmate harnesses. Primary-mode Cursor integration is also present in this shipped head through .cursor/hooks.json, the stop/preToolUse guard, and hook-owned turn-end supervision; no broader primary-mode feature set is claimed.

What Changed

• Add verified Cursor Agent support across harness detection, executable resolution, spawning, session locking, tmux and Herdr backends, remote readiness, liveness, and worker-server teardown. Detection is narrowed to trusted cursor-agent identity or a proven legacy alias; unrelated agent processes, bare interpreters, and unverified aliases fail closed.
• Add tracked Cursor stop and preToolUse hooks with Cursor-formatted deny responses, hook-owned turn-end supervision, continuation re-arming, bounded wake chains, and safe follow-up handling.
• Extend shared composer, ghost-text, busy-queue, and submission logic for Cursor's → prompt, Add a follow-up idle state, ghost rendering, and Enter-while-busy queue behavior across tmux and Herdr.
• Contain detached Cursor worker servers by recording PID and start-time identity at spawn, reaping only the recorded process on teardown, and covering nested and secondmate cleanup without touching recycled PIDs or unrelated workers.
• Apply review hardening for bounded and fail-closed Cursor probes, narrowed argv/process identity detection, remote readiness, wake-chain and identity-free fallback scoping, hook validation, and cleanup containment.
• Keep harness-pinned suites hermetic under ambient CURSOR_AGENT, deduplicate resolver and shared arrow/glyph predicates, parameterize wake-refire coverage, keep the Cursor shim contract beside its implementation, and build follow-up JSON with jq.
• Update harness, backend, supervision, runtime-verification, remote-secondmate, and teardown documentation, with regression coverage for detection, spawning, session locks, liveness, hooks, composer/ghost behavior, busy submission, remote doctor readiness, teardown, and fixture hermeticity.

How it was validated

• Focused suites passed for fm-composer-lib, fm-composer-ghost, fm-turnend-guard, fm-remote-doctor, fm-spawn-dispatch-profile, Cursor harness detection, session locking, tmux/Herdr behavior, liveness, session start, busy submission, remote secondmates, and teardown.
• bin/fm-lint.sh passed.
• bin/fm-doc-audience-check.sh passed.
• No-mistakes finalization gates passed for intent, rebase, review, test, document, lint, and push; CI was skipped per standing policy and upstream CI is monitored separately.
• Current PR head: 929c4f43bd8c621d5513116430f3a2a2e39f64a6.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ **Rebase** - passed

✅ **Review** - completed

🔧 **Test** - 2 issues found → auto-fixed (2) ✅

✅ **Document** - passed

✅ **Lint** - passed

✅ **Push** - passed

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1726 at 77c909c0.}

[kunchenguid]

Automated reminder: thanks for the PR! This branch currently has a merge conflict with the base branch.

When you get a chance, please rebase onto (or merge) the latest base branch, resolve the conflict, and push. After that, checks will re-run and the PR will get looked at again.

_{Noted for firstmate#1726 at fb4ac914.}