Add Cursor Agent as a core SkillOpt target backend

[jamesmdavies88]

Summary

Adds Cursor Agent as a target-only core SkillOpt execution backend. This is the core harness portion split from #159 so it can be reviewed independently from SkillOpt-Sleep.

Changes

• adds cursor_exec as a target backend, with cursor and cursor_agent aliases
• defaults Cursor target rollouts to Composer 2.5 while keeping the optimizer separately configured
• invokes authenticated cursor-agent through stdin and parses terminal stream-JSON results
• uses Ask mode for read-only rollouts
• supports adapter-controlled file-edit rollouts with --force inside the benchmark workspace
• sanitizes persisted Cursor traces and validates additional data directories
• exposes executable and sandbox configuration through the existing core config surfaces
• rejects allow_file_edits=True with cursor_exec_sandbox=disabled before spawning Cursor Agent

Read-only Ask-mode rollouts may explicitly disable Cursor sandboxing. File-edit rollouts require sandboxing to remain enabled.

This PR does not add Cursor as an optimizer backend and contains no SkillOpt-Sleep plugin, transcript harvesting, or replay code. That work remains in #159, where Cursor tool-aware Sleep replay has now been disabled pending live permission-boundary validation.

Validation

• python -m pytest tests/test_cursor_exec_backend.py -q: 15 passed
• python -m pytest -q: 333 passed, 5 skipped
• python -m mkdocs build --strict: passed
• targeted Ruff checks: passed
• git diff --check: passed

The Cursor CLI arguments and stream-JSON behavior were also checked by the #159 reviewer against Cursor Agent CLI 2026.07.17.