chore(env): make Cloud Agent environment usable on Linux

[s3lcsum]

What

Makes the repo's .cursor/environment.json work for Linux Cloud Agents, not just the macOS self-hosted vibe MacBook worker.

Previously the install step was command -v brew >/dev/null 2>&1 || exit 0 followed by brew install colima/kind/helm/kubernetes-cli. On a Linux Cloud Agent VM brew doesn't exist, so install exited immediately and none of the repo's dev/CI tooling was set up. The start hook likewise pointed at a Mac-only path.

Change

install now branches on the platform:

• macOS (brew present): unchanged — installs colima, kind, helm, kubernetes-cli for the local KIND vibe cluster.
• Linux (Cloud Agent): idempotently installs the repo's verification toolchain:
  • OpenTofu, pinned to terraform/.opentofu-version (1.12.5) — for make check / tofu fmt / tofu validate
  • tflint 0.64.0 — used by the terraform_tflint pre-commit hook
  • pre-commit + uv, and python3-yaml (PyYAML) for the check-consistency.py / test_security_invariants.py scripts

start is unchanged (still guarded, a no-op off the Mac).

Validation (on a Linux Cloud VM)

Check	Result
install from clean state	Installs OpenTofu 1.12.5, tflint 0.64.0, pre-commit 4.6.2, uv 0.12.10
install idempotence	Re-run is a ~3s no-op
make test (security invariants + consistency)	Pass (exit 0)
tofu fmt -check -recursive terraform/	Clean across all modules
tofu validate (per module via pre-commit)	Pass for all 11 modules
pre-commit run --all-files	Hooks execute; only pre-existing content fixups surface (out of scope)

Notes

• No application code changed — only the environment config.
• The root Makefile still has serve/build/lint MkDocs targets, but mkdocs.yml was dropped in a4ce83b, so those are already non-functional and are intentionally not wired up here.