[RELEASE] Cursor + Copilot CLI posture providers (carries #5063)

[vivekchand]

Carries #5063 (merged as 7a29db4).

Two of the 18 runtimes that answered the posture panel with "No security posture checks implemented yet" now have real checks.

Both runtimes are closed source, which forced an explicit grading rule that now binds every future provider (recorded as ADR-004 on the Local Observability Service blueprint):

• FAIL is reserved for filesystem facts, where "is it honored?" does not arise: a credential written literally into MCP config, invisible Unicode in an agent rules file, a trusted folder of "/", an approval-bypass switch in a shell profile.
• WARN covers anything documented or observed-on-disk only, and never fails. Inherited defaults count as unmeasured, not safe.
• A setting we cannot read at all is reported as an explicit unknown carrying zero weight, so it cannot move the grade.

The rule comes from a near miss: a proposed check for another runtime keyed on a field that sounded like an auto-approve switch and did default to enabled, but which that runtime's code never reads. It would have failed every clean install, and a check that fails on a healthy machine teaches the operator to ignore the grade.

Verified on a live machine: Cursor B/80, Copilot B/80, zero false failures. A test asserts a bare install of either runtime produces no failures.

🤖 Generated with Claude Code

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.

[vivekchand]

Maintenance pass handoff — branch updated against the new main (rebased past #5061 gatewayLogLevel, #5062 Windows signing, #5069 README ordering). CI is re-running on the new head.

This PR is ready to merge once CI is green, but merging triggers release-on-merge which publishes to PyPI — that step requires human confirmation. When you are ready to ship the Cursor + Copilot posture-provider wheel, merge this PR. The bot version bump in #5068 is the corresponding version bump; merge that one right after (or let the release workflow handle it automatically).

---

Generated by Claude Code