ci: enable Cursor Max Mode for cursor-agent workflow

[rgarcia]

Problem

The fix job invokes cursor-agent with --model ${{ vars.CURSOR_PREFERRED_MODEL }} (currently claude-opus-4-8-xhigh), which requires Cursor Max Mode. CI fails with Max Mode Required because:

1. The model requires Max Mode.
2. A fresh cursor-agent install defaults to maxMode=false; it must have {"maxMode": true} written to cli-config.json.
3. GitHub-hosted runners set XDG_CONFIG_HOME=/home/runner/.config, and cursor-agent resolves its config dir as CURSOR_CONFIG_DIR || $XDG_CONFIG_HOME/cursor || ~/.cursor. So ~/.cursor/cli-config.json is ignored unless CURSOR_CONFIG_DIR is pinned.

Fix

Adds an Enable Cursor Max Mode step immediately after the Cursor CLI install step and before the agent invocation, in the same fix job. It writes {"maxMode": true} to $HOME/.cursor/cli-config.json and pins CURSOR_CONFIG_DIR via $GITHUB_ENV so later steps (the agent invocation) pick it up. Same proven fix used in kernel/kernel.

Note

Requires a Max-Mode-entitled CURSOR_API_KEY secret for the model to be permitted.

Made with Cursor

---

Note

Low Risk
Workflow-only change; no application runtime or security logic is modified beyond fixing Cursor CLI configuration in CI.

Overview
Adds an Enable Cursor Max Mode step in the vulnerability remediation fix job, right after Cursor CLI install and before Socket/agent runs.

The step writes {"maxMode": true} to $HOME/.cursor/cli-config.json and exports CURSOR_CONFIG_DIR so cursor-agent picks up that config on GitHub-hosted runners (where default config paths under XDG_CONFIG_HOME would otherwise ignore ~/.cursor). This unblocks the fallback agent invocation that uses ${{ vars.CURSOR_PREFERRED_MODEL }} when Socket apply leaves no diff.

^{Reviewed by Cursor Bugbot for commit 180efaa. Bugbot is set up for automated code reviews on this repo. Configure here.}