fix(cli): add early validation for Cursor API key format

[DhruvTilva]

Adds a simple check to ensure CURSOR_API_KEY starts with crsr_.

Right now, invalid keys only fail after an API call, which can be confusing. This change catches mistakes early and shows a clear error message.

For example:

• abc123 → fails immediately with clear message
• crsr_xxx... → works as expected

This matches the validation already used in app-builder, so behavior stays consistent.

no risk only blocks keys that would fail anyway.

---

Note

Low Risk
Low risk: adds a simple preflight check on an environment variable and fails fast with a clearer error, without changing any API behavior beyond earlier rejection of invalid keys.

Overview
Adds early validation in the coding-agent-cli entrypoint to trim CURSOR_API_KEY and reject keys that don’t start with crsr_, surfacing a clear error before any prompt/session work begins.

^{Reviewed by Cursor Bugbot for commit b192d33. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high mode and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 7e50b0f. Configure here.}

[DhruvTilva]

Cursor[bot] Suggested things was fixed and PR updated..