Initial segregate: proxy source, deploy manifests, ImagePolicy Flux CRs.

Move workload out of infra with cursor-devbox-style GitRepository +
run_number-sha image automation.

scripts/bootstrap-cursor.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Bootstrap: seed ~/.cursor/cli-config.json and verify the cursor-agent
+# binary works before the HTTP server starts serving traffic.
+set -euo pipefail
+
+CURSOR_HOME="${HOME}/.cursor"
+BOOTSTRAP="/opt/cursor-bootstrap"
+export NO_OPEN_BROWSER=1
+
+mkdir -p "${CURSOR_HOME}"
+
+if [[ -f "${BOOTSTRAP}/cli-config.json" ]] && [[ ! -f "${CURSOR_HOME}/cli-config.json" ]]; then
+  cp -f "${BOOTSTRAP}/cli-config.json" "${CURSOR_HOME}/cli-config.json"
+fi
+
+# cursor-agent auth via env (no interactive login).
+if [[ -z "${CURSOR_API_KEY:-}" ]]; then
+  echo "CURSOR_API_KEY is not set" >&2
+  exit 1
+fi
+export CURSOR_API_KEY
+
+# cursor-agent itself must respond.
+if ! /usr/local/bin/agent.real --version >/dev/null 2>&1; then
+  echo "cursor-agent binary is not executable" >&2
+  exit 1
+fi
+
+echo "cursor-agent bootstrap: auth ok, agent responds"