[Subscription Providers 3/7] Cursor AgentService exchange backend

[NOirBRight]

Part of #603.

Acceptance

Implement CLI-authenticated AgentService/Run behind the Gateway exchange interface without Magpie or ACP as production dependencies. Use exact vendor model identity, effort/fast variants, no nearest-model fallback. Carry text, streaming, full history, caller dynamic tools/results, framing/blobs/keepalives and errors. Only caller tools are available. Disconnect closes upstream and cleans streams; no invented billing/cancellation acknowledgement. Account change invalidates active identity; official CLI owns refresh. Reuse Responses/Chat/Messages adapters, immutable Route Plan and truthful telemetry. Test framing/lifecycle/errors/auth and isolated real tool roundtrip. Full V2 acceptance also depends on ticket 2.

Dependencies

#604

Verification

Risk class: strict. Follow docs/agents/verification-policy.md and docs/specs/cli-subscription-providers.md. Historical feasibility does not qualify the production candidate.

[NOirBRight]

Parent has accepted the original-clause reconciliation against published 584f2edbe5d4d5b28250d13bde6d707ea0d447ca. The AgentService/Run backend, exact model handling, framing/flow-control/blobs, caller tool ownership, history/Call identity, auth/active-account checks, disconnect cleanup, immutable Route Plan and truthful telemetry have concrete implementation and named deterministic evidence. Parent independently checked the selected backend/transport/exchange modules' existing XML: Linux82PASS; Windows81PASS/1 unchanged POSIX-fixtureSKIP,0failure/error. Actual ordinary tool/restart and the latest scoped reverse-V2 live receipts retain their original SHA and limits; no new tests/live/account access or source edits ran.

#606 remains OPEN because Messages is still unsupported in the actual backend: mandatory max_tokens is rejected withHTTP400 until a qualified native whole-response cap exists. The passing fake-backend adapter test proves that the128 value is preserved; it does not prove native enforcement. This is an existing requirement from the original issue/spec and #634, not a new gate.

Registered #634 as native blocker for #606. Its existing external blockers are #636/#637; the Cursor capability gap is specifically #637, followed by Cursor-specific implementation/qualification under #634. Agent code must not guess parameter IDs, transplant legacy fields, silently drop the limit, or substitute prompt hints/local estimates. No new research ticket or unchanged live/full-matrix retry is selected.

Full V2 authoritative assignment/history acceptance stays explicitly scoped to #605/#638, and full real-client/dual-platform/release qualification to #609. Claude entitlement #611 is not a direct Cursor feature prerequisite. The current backend implementation and scoped ordinary evidence are retained, but they do not waive the Messages gap or claim all246 models/live platforms qualified. PR614 remains draft, providers disabled by default; root584 is unchanged.