Add Cursor agent CI fix workflow

[masnwilliams]

Summary

• Adds a GitHub Actions workflow that automatically attempts to fix CI failures using cursor-agent
• When the test workflow fails on a PR, this workflow analyzes the failure logs and proposes fixes via a compare link comment
• Modeled after the existing fix-ci workflow in the kernel monorepo

Test plan

• Add CURSOR_API_KEY secret to the repository settings
• Verify workflow triggers on next CI failure

---

Note

Introduces automated CI remediation via cursor-agent when the Run tests for the CLI workflow fails on PRs.

• New .github/workflows/fix-ci.yaml triggers on failed workflow_run events and runs on ubuntu-latest
• Installs cursor-agent, configures git identity, sets up Go from go.mod, and uses gh run view <id> --log-failed for diagnostics
• Generates minimal fixes, pushes to ci-fix/<pr-head-branch>, and posts a PR-ready compare link as a comment
• Scoped permissions: contents/pull-requests write, actions read; avoids creating PRs directly and prevents duplicate comments

^{Written by Cursor Bugbot for commit 7f03716. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Checkout checks out wrong branch in workflow_run context

High Severity

The actions/checkout step is missing a ref parameter. In a workflow_run context, checkout defaults to the repository's default branch (e.g., main), not the PR branch that caused the CI failure. The cursor-agent will analyze and attempt to fix code on the wrong branch. To check out the PR branch, a ref like ${{ github.event.workflow_run.head_sha }} is needed.