docs: add Cursor Cloud environment setup notes

[rrama]

Description

Adds a ## Cursor Cloud specific instructions section to AGENTS.md (and therefore
CLAUDE.md, which is a symlink to it), capturing the non-obvious setup gotchas an
agent hits when building GAF in a Cursor Cloud Linux VM. Documentation only — no
product code, and no change to any exported API, config key, workflow identifier or
content type.

Two duplicate cloud-setup PRs had been opened against this repo by successive cloud
runs. This one now carries the consolidated content and #670 has been closed as
superseded, leaving a single PR per repo.

The notes cover:

• GOTOOLCHAIN=go1.26.5 must stay pinned. go.mod declares a bare go 1.26, so
  with GOTOOLCHAIN=auto Go tries to fetch a non-existent go1.26 toolchain from
  go.dev and fails; the pin routes it through proxy.golang.org.
• make tools curls golangci-lint.run (Makefile:50), which is usually outside
  the allowlist. Install the pinned v2.10.1 from the module proxy into .bin/
  instead. GAF is the odd one out here — snyk-ls and code-client-go fetch the same tool
  via raw.githubusercontent.com.
• pkg/networking.Test_GetHTTPClient is network-gated, not broken. It does a live
  GET https://www.snyk.io, which 301-redirects to the bare snyk.io apex; it passes
  whenever that apex is reachable and only fails (nil-dereferencing on the unchecked
  error path) when the egress is missing.

What changed since the first revision

• Reframed the networking test as an environment limitation rather than a defect,
  and kept the other branch's more precise diagnosis — the www → apex redirect is
  what makes it fail, which is easy to misread as www.snyk.io being blocked. It now
  also points at test(networking): remove live snyk.io call from Test_GetHTTPClient #673, which replaces the live call with an httptest server and makes
  the caveat moot once merged.
• Removed the hard-coded reachable/blocked host list. The egress allowlist changes
  between runs, so a fixed map goes stale and gets trusted anyway. Readers are told to
  probe directly, with the semantics that explain the failure above: bare entries are
  apex-exact while *.example.com covers subdomains only, so *.snyk.io does not
  imply the snyk.io apex.

Checklist

• Tests added and all succeed (make test) — n/a, no code changes; markdown only
• Regenerated mocks, etc. (make generate) — n/a, nothing generated is affected
• Linted (make lint) — n/a, no Go files touched
• Test your changes work for the CLI — n/a, documentation only; nothing for the CLI
  to consume and no go.mod/go.sum change, so no companion CLI PR is needed

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.