Capture bounded Cursor Work Episodes

[hopeatina]

Summary

• pass Cursor user requests and native lineage into the shared Wizard hook
• derive safe action effect and target descriptors without forwarding tool arguments or results
• enable bounded Work Episode capture from the plugin bridge
• update privacy documentation to match the actual contract

Evidence

• plugin manifest verification passed
• 23 tests passed
• package tarball inspection passed
• four-client emitted-hook-to-server canary passed

Dependencies

• merge after hopeatina/orgx#2752 and the Wizard Work Episode PR