chore: Add content-driven multi-repo Cloud Agent environment

[erezrokah]

What

Adds a repository-managed Cloud Agent environment that supports every repo mounted in the workspace, not just this one. Tools are not baked into a base image — instead the install script scans each repo's content on every provisioning and installs the pinned toolchains that repo actually needs. Version bumps in the repos are picked up automatically on the next run.

• .cursor/environment.json — default base image + idempotent install. No start/terminals.
• .cursor/install.sh — locates all repos in the workspace (/agent/repos/*, falls back to the single primary repo), detects each repo's toolchain from its own files, and installs the union of pinned tools. Idempotent: already-correct tools are detected and skipped, so re-runs take ~3s.

Detection → tools (all versions read from repo content, overridable via env)

Signal in a repo	Tools installed
go.mod	Go toolchain (auto per go.mod) + golangci-lint (version parsed from that repo's CI workflow, e.g. v2.12.2)
package.json / pnpm-lock.yaml (+ .nvmrc, engines, packageManager)	Node via nvm (majors + exact .nvmrc pins, e.g. 24.12.0) + pnpm via corepack (each pinned packageManager)
terramate.tm.hcl / *.tf	Terraform (1.14.7 from config.tm.hcl) + Terramate
.tflint.hcl	TFLint (v0.52.0 from CI)
.terraform-docs.yml	terraform-docs
kustomization.yaml	kustomize
Chart.yaml / HelmRelease YAML	helm
toolkit.fluxcd.io / flux check YAML	flux
.pre-commit-config.yaml	pre-commit

Node shims are symlinked into ~/go/bin (which precedes /exec-daemon on PATH) so the detected Node version wins over the workspace's default /exec-daemon/node.

Verification

Validated on the provisioned workspace VM (all six repos present): cloud-infrastructure, cloudquery-platform-api-go, frontend, platform, platform-cli, platform-gitops.

Check	Result
Detection per repo	Correct for all 6 (see log)
First install (cold)	~84s, exit 0
Re-run idempotence	~3s, every tool "already present", exit 0
node resolves to detected version	v24.12.0 (wins over /exec-daemon/node v22.14.0)
pnpm per-repo via corepack	frontend → 10.23.0 while global default is 10.34.4
golangci-lint run	0 issues on cloudquery-platform-api-go and platform-cli
terramate list (cloud-infrastructure)	Lists stacks
kustomize build (platform-gitops)	Renders 124 lines of manifests
terraform / tflint / terraform-docs / helm / flux / pre-commit	Resolve at pinned versions

Installed versions: go 1.26.5, golangci-lint 2.12.2, node 24.12.0, pnpm 10.23.0/10.34.4, terraform 1.14.7, terramate 0.17.2, tflint 0.52.0, terraform-docs 0.24.0, kustomize 5.8.1, helm 3.21.4, flux 2.9.4, pre-commit 4.6.2.

Note on the linked environment vs the workspace

environment-info reports only cloudquery-platform-api-go as the linked repo, so a draft build checks out just that repo and exercises the single-repo path (Go + golangci-lint) plus idempotence. The full multi-repo detection was validated on the provisioned workspace VM above, and the snapshot captures that warm state. To have fresh agents check out all six repos, add the others as repositoryDependencies (or link them) in the environment settings.

Note on CLOUDQUERY_API_KEY

A CLOUDQUERY_API_KEY secret is injected as a global env var. Three non-hermetic auth tests in this repo read it, so run env -u CLOUDQUERY_API_KEY make test (matches CI). No library/test code was changed.

Below the cut

Attached artifacts: install.sh (the detector), environment.json, and multirepo_validation.log.