Cursor Marketplace Claude Code Extension Supply-Chain Compromise & Persistent SSH Backdoor

MERGED — concurrent closure dedupe found that CY-DOM-007 had already canonically committed the exact Oct-29 Cursor marketplace incident. No second active Topic, evidence set, hypotheses or gaps are retained; AIS provenance and watch state remain.