docs: add Cursor Cloud environment setup notes

[rrama]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable) — none, documentation only
• Links to automated tests covering new functionality — n/a, no product code changes
• Includes manual testing instructions (if necessary) — n/a
• Updates relevant GitBook documentation (PR link: n/a — AGENTS.md is repo-local agent guidance, not user docs)
• Includes product update to be announced in the next stable release notes — n/a, internal documentation

What does this PR do?

Adds a ## Cursor Cloud specific instructions section to AGENTS.md, capturing the
non-obvious setup gotchas an agent hits when building this repo in a Cursor Cloud
Linux VM. Documentation only — no product code, build or CI changes.

Two duplicate cloud-setup PRs had been opened against this repo by successive cloud
runs. This one now carries the consolidated content and #7044 has been closed as
superseded, leaving a single PR per repo.

The notes cover:

• Node/npm must come from nvm v22.22.3, not /exec-daemon/node (which ships no
  npm) — the root .npmrc sets engine-strict=true against "npm": "^11.12.1".
• GOTOOLCHAIN=go1.26.5 must stay pinned, so the toolchain resolves via
  proxy.golang.org rather than go.dev.
• make build BUILD_MODE=public plus the convco prerequisite.
• The license-prep workaround, corrected: go-licenses save --force wipes
  cliv2/internal/embedded/_data/licenses/ first, so the Go LICENSE has to be placed
  after a build and the make target stamped. The other PR claimed pre-placing the
  file was enough, which does not survive the --force.
• Why make lint keeps re-running the golangci-lint installer: cliv2/Makefile
  never assigns TOOLS_BIN, so the prerequisite resolves to a missing
  /golangci-lint. Also notes that cliv2 pins v2.9.0 while the other Snyk Go repos
  use v2.10.1.

What changed since the first revision

• Verified every Makefile claim against the checked-in cliv2/Makefile rather than
  relying on the original run's notes (OVERRIDE_GOCI_LINT_V := v2.9.0, GO_BIN := $(shell pwd)/.bin, TOOLS_BIN unset, and the $(CACHE_DIR)/prepare-3rd-party-licenses
  target having no prerequisites).
• Removed the hard-coded reachable/blocked host list. The egress allowlist changes
  between runs, so a fixed map goes stale and gets trusted anyway. Readers are now told
  to probe directly, with the matching semantics that actually matter: bare entries are
  apex-exact while *.example.com covers subdomains only, and a block shows up as a TLS
  reset mid-handshake rather than a DNS failure.

Where should the reviewer start?

AGENTS.md is the only changed file — read the new section at the bottom. The main
thing worth a second opinion is whether the license-prep workaround is described
accurately enough to follow.

How should this be manually tested?

Nothing to run. To confirm the guidance, follow the section in a fresh cloud VM:
PATH="$HOME/.nvm/versions/node/v22.22.3/bin:$PATH" make build BUILD_MODE=public
should produce ./binary-releases/snyk-linux.

What's the product update that needs to be communicated to CLI users?

None — internal contributor/agent documentation.

Risk assessment

Low. Markdown only; no product, build or CI behaviour is affected.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Fails
🚫	"merge: sync main into cloud env setup notes branch" is not using a valid commit message format. For commit guidelines, see: CONTRIBUTING.

	Warnings
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found: AGENTS.md
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 1ab5da9

[github-actions]

Your PR has not had any activity for 30 days. In 2 days I'll close it. Make some activity to remove this.

[github-actions]

Your PR has now been stale for 2 days. I'm closing it.

[cursor]

Still being worked on by the cloud agents — branch has been updated with a merge from main and an additional note under Building with Local Dependencies about local-only go.mod replace directives (including the snyk-ls example for IDE testing).