fix(adapters): stop guessing Cursor plugin IDs

[U1oSun]

Summary

• Stop assigning unknown numeric or opaque Cursor install-record IDs to cached plugins by name/order.
• Keep only evidence-backed matches: direct cursorPluginId matches and workspace project-MCP hints.
• Preserve unknown record IDs in diagnostics instead of reporting an unrelated plugin as installed.

Why

• Issue/Story: roadmap.md U-01.
• User or maintainer outcome: Cursor inventory is stable across cache ordering and no longer produces false installed-plugin attribution from undocumented IDs.

Traceability and Scope

• Spec/ADR: docs/specs/2026-07-30-u-01-cursor-plugin-id-matching.md
• Acceptance criteria addressed: U01-AC-1 through U01-AC-5.
• Canonical owners changed: Cursor provider, its focused tests, roadmap, changelog, and the U-01 spec.
• Explicit non-goals: no new Cursor data source, no decoding of undocumented state, and no changes to session/checkup/report routing.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
Pre-fix focused regression	0/2 as expected: ID 9001 was assigned to Future Tool, and cache order changed attribution
node --test test/agent-customize.test.mjs test/agent-customize-architecture.test.mjs	33/33 passed
node --test test/doc-link-graph.test.mjs	6/6 passed
npm --cache .npm-cache run pack:verify	Passed: 333 npm entries, 356 runtime ZIP entries
git diff --check origin/main..HEAD	Passed
npm test	980 total: 973 passed, 3 skipped, 4 Windows symlink-permission failures; no Cursor-provider failure

Manual or visual evidence: the pre-fix provider attached unknown IDs by cache order; the fixed inventory returns no plugin for those records and reports the unknown IDs in unmatchedInstalledPluginIds. A focused rerun confirmed all four full-suite failures are EPERM while creating symlinks in unrelated scope/render/topology tests.

Risk and Recovery

• Compatibility and cross-platform impact: inventories may contain fewer installed plugins when Cursor exposes an ID that cannot be proven locally; this is the intended fail-closed behavior. Direct-ID and project-MCP matches remain covered.
• Package, plugin, schema, or generated-file impact: no dependency, schema, or generated-file changes; existing diagnostic keys remain present and installedPluginFallbackCount remains numeric at zero.
• Rollback or recovery path: revert commit 2d5a966a9a60718ae4dd5c3843cf4435d54a6f45.
• Residual risk or unverified boundary: local Node v22.17.0 and npm 10.9.2 are below the repository minimums; CI should confirm on the supported toolchain and a symlink-capable host.

AI Involvement

• Level: Assisted (Codex, GPT 5.6 Sol).
• Human review and validation: the contributor approved the scoped problem and test strategy; Codex inspected the final diff and ran the recorded automated gates.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.