feat(stats): add Cursor attribution parity

[rodboev]

tkmx-client still needs Cursor attribution parity before it can retire the last legacy Cursor collector. AgentsView already ingests Cursor transcripts, but it still ignores ~/.cursor/ai-tracking/ai-code-tracking.db, so the stats payload has no commit-level tab, composer, human, or conversation-count attribution from Cursor itself.

This keeps the scope to the surviving Cursor attribution slice from #358. The new reader lives beside the existing Cursor parser, can be redirected with AGENTSVIEW_CURSOR_ATTRIBUTION_DB, follows Cursor's live schema by windowing scored commits on scoredAt while leaving the text commitDate column as metadata, and leaves transcript discovery untouched. Aggregation stays owned by service stats code, and the result lands in a dedicated top-level cursor_attribution block rather than being mixed into git-derived outcome_stats or folded into the session-derived agent_portfolio maps. That preserves the meaning of the existing stats owners while giving downstream consumers one explicit Cursor attribution surface to read.

Project include and exclude filters still suppress the block because Cursor's local attribution DB has no project key, and non-Cursor agent filters keep it nil for the same reason. The human-readable stats output only renders the section when the service-owned block is present.

PR #413 stays separate. It covers Cursor state.vscdb session ingestion, which is a different Cursor data source from ai-code-tracking.db and does not provide the line-attribution totals required here.

Closes #358

[roborev-ci]

roborev: Combined Review (3d90fd7)

Medium finding: internal/service/direct.go:749 - shouldLoadCursorAttribution treats any all token as an all-agent filter, while the stats DB query treats non-empty Agent values literally. Inputs like Agent: "all" or --agent all,codex can return stats excluding Cursor sessions while still appending unfiltered Cursor attribution. Normalize the agent filter once before both GetSessionStats and attribution loading, or only load attribution for an empty filter or CSV tokens that actually include cursor.

---

Panel: ci_default_security | Synthesis: codex, 7s | Members: codex_default (codex/default, done, 6m45s), codex_security (codex/security, done, 2m32s) | Total: 9m24s

[roborev-ci]

roborev: Combined Review (f3528ef)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 8m41s), codex_security (codex/security, done, 32s) | Total: 9m13s

[wesm]

fixing windows CI

[roborev-ci]

roborev: Combined Review (c7021fc)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 4m55s), codex_security (codex/security, done, 1m0s) | Total: 5m55s

[roborev-ci]

roborev: Combined Review (3c85e57)

No issues found.

---

Panel: ci_default_security | Synthesis: codex | Members: codex_default (codex/default, done, 6m5s), codex_security (codex/security, done, 50s) | Total: 6m55s

[wesm]

This PR has cleared review but I think we need to take a step back and think about how this API is realistically going to evolve to support many harnesses and providers. Since I need to get a release out to fix bugs in 0.35.0 I'm going to cut that now and then take time to give this appropriate consideration