[codex] Phase 3F: safe web runtime fixes

[sukar0972]

Summary

Phase 3F applies a small set of web-safe upstream runtime fixes before the larger Phase 4 preview/browser-simulation work:

• improve Cursor CLI missing-command and ACP discovery setup guidance
• reject unsupported remote pairing protocols before they reach connection setup
• restore native keyboard activation for pending user-input choices
• ignore stale shell snapshot reducer events defensively

Intentionally deferred from this phase

• c1e2408e1 / browserTargetResolver preview-host handling: deferred with browser/preview simulation work because this fork does not have that resolver path.
• ea52bb1db trace ID clipboard UI: not directly portable because current saved-backend runtime state has no traceId field.
• c6c64918f ChatMarkdown rerender reduction: overlaps a larger markdown chrome/table-copy refactor and should be handled with the UI phase instead of this small runtime-fix PR.
• 28107e89c diff component rename cleanup: obsolete in this fork; the old active path is already gone.

Grok Composer 2.5 review

Reviewed with grok -m grok-composer-2.5-fast after implementation and again after removing no-op DPoP commits from the branch.

Final verdict: approve, no merge-blocking issues.

Verification

• vp test apps/server/src/provider/Layers/CursorProvider.test.ts packages/shared/src/remote.test.ts packages/client-runtime/src/shellSnapshotReducer.test.ts — 41 passed
• vp run typecheck — passed
  • existing suggestion remains: src/diagnostics/ProcessResourceMonitor.ts(315,5)
• vp check — passed
  • existing react(no-unstable-nested-components) warnings remain