A Cursor zero-day vulnerability lets a planted git.exe run automatically when a Windows developer opens a repository.