ci: use org variable for CURSOR_PREFERRED_MODEL

[rgarcia]

Switches agent --model ${{ secrets.CURSOR_PREFERRED_MODEL }} to ${{ vars.CURSOR_PREFERRED_MODEL }} so the model value is visible in plaintext.

The org-wide variable CURSOR_PREFERRED_MODEL has been set to claude-opus-4-8-thinking-max.

Part of an org-wide migration of this key from secret to variable. The secret will be deleted once all repos are migrated.

🤖 Generated with Claude Code

---

Note

Low Risk
Workflow and documentation-only change; no application or auth logic, though repos must set the variable or agent steps will fail.

Overview
Cursor agent invocations in Semgrep triage and vuln remediation fallback fix now read the model name from ${{ vars.CURSOR_PREFERRED_MODEL }} instead of a repository/org secret, matching an org-wide move so the value can be a normal (visible) variable.

README documents CURSOR_PREFERRED_MODEL under a new Required variables section and removes it from Required secrets. Consumer repos must define the org/repo variable (and can drop the old secret after migration).

^{Reviewed by Cursor Bugbot for commit 1c9e525. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

PRs in the kernel, infra, hypeman, and hypeship repos. kernel is a ~mono repo with many logical services underneath, ensure to focus on the implicated service for the PR

Reason: PR repository is not specified in the provided information; cannot confirm if this is in one of the four required repos (kernel, infra, hypeman, hypeship).

To monitor this PR anyway, reply with @firetiger monitor this.