chore(cloud): add Cloud Agent development environment

[Whamp]

Summary

Adds a Cloud Agent development environment for pi-brain so agents can install dependencies, run the full validation suite, and exercise the extension without manual setup.

• .cursor/environment.json — declares the environment with an idempotent install step.
• .cursor/install.sh — pins pnpm@10.33.3 (matching the committed lockfile), installs the real gitleaks binary, then runs pnpm install --prod=false --frozen-lockfile.

Why these steps

• The npm gitleaks@1.0.0 devDependency is a config-only decoy package that ships no binary, but pnpm run check's secrets step invokes the real gitleaks CLI. The script installs the official gitleaks 8.28.0 Go binary (idempotently) so the check passes.
• .npmrc sets omit=dev, so --prod=false is required to pull in the toolchain (oxlint, vitest, typescript, etc.).
• The repo declares no packageManager field, so the script activates an explicit pnpm version rather than letting corepack resolve "latest" (which triggered a node_modules purge prompt during testing). CI=true keeps pnpm non-interactive.
• No start/terminals: pi-brain is an extension/library with no long-running services.

Validation

Validated on the VM, then across two prebuilt environment builds, each verified in a fresh Cloud Agent.

Check	Result
install.sh idempotence (VM)	Ran twice, clean
pnpm run check (lint, typecheck, format, deadcode, duplicates, secrets, test)	All passed; 214/214 tests
Extension end-to-end (SDK, no LLM)	Loaded src/index.ts into a real pi AgentSession, registered memory_branch + memory_commit, created/switched memory branches, wrote .memory/ artifacts, and rejected an invalid branch name
Build from snapshot + fresh agent	SUCCEEDED; Node 22.14, pnpm 10.33.3, gitleaks 8.28.0, pnpm run check passed
Build from default image (no snapshot) + fresh agent	SUCCEEDED; confirms install.sh is self-contained — gitleaks downloaded to /usr/local/bin, pnpm run check passed with "no leaks found"

Because .cursor/environment.json is committed, the repository file is the highest-precedence environment source: once merged, new Cloud Agents on this repo use it automatically.

Notes

• Unrelated observation (not addressed here): .github/workflows/check.yml currently fails at pnpm/action-setup with "No pnpm version is specified", because the repo declares no packageManager field and the action is not pinned to a version.