ci(cursor-review): bump Cursor CLI pin to 2026.10.16-e3cb207

[cloud-code-bot]

ELI5

This moves the code-review bot onto a newer release of the Cursor command-line tool. Both places that install the tool now agree on the same version and checksum, so every review job runs the exact same, verified download.

Moves the Cursor CLI pin cursor-review.yml installs from, and the identical pin cursor-axis-base.yml carries (a test keeps the two equal).

Version	2026.10.01-e373342 → 2026.10.16-e3cb207
sha256 (linux/x64 agent-cli-package.tar.gz)	3aa3f48cd7a3909a98c9b3f2a4085f0c021088bf826690b22c61f424c843e552
nixpkgs cross-check	not-yet-available — nixpkgs is still on 2026.10.01-e373342
second independent download	matches — a fresh download from a separate host hashed to the same digest
smoke test	passed — install-cursor-cli.sh installed this artifact and the binary self-reported 2026.10.16-e3cb207

You are the trust anchor for this digest. Cursor publishes no checksums for these artifacts, so the sha256 above is what the CDN served during this run, corroborated by one later independent download from a different host. Nothing downstream can check it further.

Merging this bumps cursor-review.yml, which triggers bump-cursor-review-callers.yml and rolls the SHA-pinned caller fleet forward.

Opened by the bump-cursor-cli-pin workflow.

Provenance

Verified:

• Both pins (cursor-review.yml, cursor-axis-base.yml) carry 2026.10.16-e3cb207 / 3aa3f48c…e552.
• The digest re-verified by an independent download of the linux/x64 artifact.
• cursor-approve (338) and cursor-review (1732) unittest suites pass locally, including the pin-parity test that failed on the first push.
• check_workflow_pins.py and the org-repo-literal lint pass.

Deviations:

• The opening workflow bumped only cursor-review.yml; the cursor-axis-base.yml pin was moved in a follow-up commit by the review loop so the pin-parity test passes. The bump workflow itself still edits one file, tracked separately.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e0baf297-5d10-4dce-b774-9d19d8e7af0b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mattmillerai]

🤖 The reviews loop filed Linear follow-up ticket(s) for review thread(s) deferred as out of scope for this PR:

• BE-21514 — Make bump-cursor-cli-pin.yml move the Cursor CLI pin in cursor-axis-base.yml as well as cursor-review.yml — filed as agent-spike (premise unverified)

The following carry agent-spike instead of agent-ok because their reachability claim was not backed by evidence (BE-5378) — the claim is investigated before any code is written, and "the premise does not hold" is a valid, successful outcome:

• Make bump-cursor-cli-pin.yml move the Cursor CLI pin in cursor-axis-base.yml as well as cursor-review.yml — no reachability block in the proposal