fix(mascot): map cursor-cli and qoder-cli to correct mascots

[zephyr110]

Fixes follow-up reported in #220.

Summary

• Map cursor-cli and qoder-cli to the Cursor / Qoder mascots in MascotView and SharedMascotView.
• Bridge already promotes terminal cursor-agent / qodercli sessions to -cli IDs (请求支持 cursor-agent 和 qodercli #134); ESP32Protocol and SessionSnapshot.sourceLabel already handle them. Only the SwiftUI mascot router was missing these cases, so sessions fell back to the default Clawd (Claude Code) mascot.
• Align iOS companion source labels in CompanionDisplayText (CURSOR / QODER instead of uppercasing the raw ID).
• Also fix a duplicate com.apple.security.cs.disable-library-validation key in CodeIsland.entitlements that breaks ./build.sh codesign when building from source.

中文说明

• 在 MascotView / SharedMascotView 中为 cursor-cli、qoder-cli 补上吉祥物路由，复用现有 Cursor / Qoder 角色（与 请求支持 cursor-agent 和 qodercli #134 设计一致）。
• 修复前：终端里的 cursor-agent / qodercli 会被 bridge 识别为 cursor-cli / qoder-cli，但 UI 层未匹配这些 source，回退成 Clawd（Claude Code）吉祥物——与 cursor终端中打开的cc显示cursor图标 #220 评论一致。
• iOS 伴侣端 CompanionDisplayText 同步处理 -cli 来源名。
• 顺带删除 entitlements 里重复的 disable-library-validation 键，修复本地 ./build.sh 签名失败。

Test Plan

• ./build.sh — release build + ad-hoc codesign succeeds
• Manual: cursor-agent session in terminal shows Cursor mascot in notch panel (not Clawd)
• Manual: qodercli session shows Qoder mascot after directory trust + hook reinstall
• Maintainer: swift test