Add Cloud Agent development environment

[djbclark]

What

Adds a Cloud Agent development environment so a fresh agent can build, test, lint, and run aiuse in one hop.

• .cursor/environment.json — default base image + idempotent install (repository-managed, highest-precedence config).
• .cursor/install.sh — installs the CI toolchain (uv, just, bun), syncs Python dev deps (uv sync --extra dev, Python pinned to 3.11 to match the CI matrix + pyproject target), installs docs tooling (bun install --frozen-lockfile), and pre-fetches the pre-commit hook environments so just ci is fast on first use.

The install command mirrors the GitHub test workflow exactly, so a Cloud Agent runs the same gate CI runs.

Design choices

• No start/terminals: aiuse is a CLI, not a long-running service, so an idempotent install is all that's needed.
• Toolchain in install (not a Dockerfile): uv/just/bun install in seconds via their official installers and are captured in the environment snapshot; keeping the default base image avoids a custom Docker build.
• Installers are downloaded to a temp file and executed, not piped into bash: the curl | bash idiom is rejected by this repo's own semgrep gate, so the script uses download-then-run to keep the gate green.
• bun/bunx symlinked into ~/.local/bin: the bun installer only appends ~/.bun/bin to ~/.bashrc, which non-interactive Cloud Agent shells don't source. ~/.local/bin is reliably on PATH (uv/just live there), so the docs-lint hooks (prettier, markdownlint) resolve bunx on a freshly booted build.

Validation

Local VM and a fresh Cloud Agent booted from the tested build bld-20260908-2598f84a-896f-419a-bc87-74425f6cd54a:

• uv run pytest — 640 passed
• uv run pre-commit run --all-files — exit 0, all hooks pass (ruff, mypy, typos, prettier, markdownlint, yamllint, bandit, semgrep, gitleaks)
• just --fmt --check — exit 0
• install.sh re-run — idempotent, no lockfile churn
• Core pipeline end-to-end — docs/generate-readme-demo.py renders the ranked clock matrix via the real analysis + render_clock_matrix code path
• Fresh-agent verification confirmed the cold install works from the default image and a bare bunx resolves on PATH

The five external data-source tools (cswap, codexbar, caut, openusage, tokscale) are intentionally not installed: per AGENTS.md they are operator-installed and require real authenticated subscriptions, so aiuse doctor reporting them missing is expected in a clean environment.

Activating

This environment is defined by the committed .cursor/environment.json, so merging this PR makes it the active, versioned, branch-following config for future Cloud Agents — no dashboard configuration required. (The draft builds used for validation were built from this branch and are non-promotable by design; a promotable build follows automatically once the config lands on main.)