feat(desktop): add Cursor CLI ACP OAuth and model selection

[SomSamantray]

Summary

Buzz can now use an installed Cursor CLI as its own ACP harness, including Cursor-owned authentication and model selection. It adds the missing vendor auth flow, ACP model discovery, startup model selection, and cross-platform launch handling on top of the existing runtime-registration work.

Design

• Discovers both agent and cursor-agent, uses the detected Cursor command on macOS/Linux, and supports the corresponding WSL guest command on Windows.
• Reads Cursor ACP authMethods and launches Cursor's own visible login flow when needed; Buzz does not store Cursor credentials or substitute a Buzz OAuth token.
• Uses ACP session/new model discovery and injects the selected model with Cursor's startup --model argument. The picker persists changes for the next launch instead of sending an unsupported live model-switch request.
• Keeps Cursor-specific startup arguments and vendor auth handling isolated from Claude Code, Codex, and generic ACP runtimes.

Related: #2418, #2536, #2773

Validation

• cargo fmt --all -- --check passed.
• git diff --check passed.
• pnpm --dir desktop check passed.
• pnpm --dir desktop typecheck passed.
• The onboarding readiness suite passed all 18 tests, including preferred Cursor runtime selection.
• Live Cursor validation passed: both agent and cursor-agent resolve, agent status reports the authenticated account, native ACP initialize and session/new succeed, the model catalog is returned, and agent --model gpt-5.5 acp reports the requested model as current.
• cargo check -p buzz-acp --offline could not reach compilation because the pinned aws-creds/rust-s3 git dependency was unavailable in this environment; the network fetch was also blocked by the environment proxy.

New concepts

Startup-only model selection

Some ACP harnesses accept a model only when the process starts rather than through an in-session control method. Buzz records that capability in runtime metadata, persists picker changes for the next launch, and suppresses live switching for those runtimes.

This is used here because Cursor owns model configuration at process startup: Buzz starts Cursor with --model <id> and lets Cursor's ACP session report the resulting model. It should not be used for runtimes that support reliable live model changes through ACP.