Build cursor-bin for aarch64 using the vendor Debian package

[scottjones]

Adds aarch64 support to cursor-bin using Cursor's official ARM Debian package. Both architectures use the same extraction flow; x86_64 continues to use system Electron, while ARM retains the vendor's bundled Electron and native helpers because electron42 is unavailable in Arch Linux ARM.

The ARM package keeps the vendor launcher, desktop entries and icon at their original paths. Packaging adds the CLI symlink and moves zsh completions to Arch's directory. Architecture-specific dependencies cover the bundled runtime. Debian AppArmor/sysctl settings are excluded from the ARM payload, and chrome-sandbox is installed as 0755 to use the unprivileged namespace sandbox.

Validation

• Native ARM build passed using OMARCHY_SKIP_BUILDER_IMAGE=1 bin/build --arch aarch64 --package cursor-bin, with a fresh package container from the existing upstream builder image. The pinned ARM Debian archive's SHA-512 passed.
• Inspected the final archive: AArch64 Electron and bundled Node, correct CLI symlink, desktop entries/icon and completions, 0755 sandbox helper, no Debian system settings, and no FUSE dependency. Both desktop entries pass desktop-file-validate with vendor category hints only.
• Reassembled the x86_64 archive on ARM with an x86_64 makepkg configuration and --nodeps. All 20,608 payload entries match the previous x86 package in contents, modes, ownership and symlink targets; its dependency set is unchanged. This is packaging validation, not native x86 runtime testing.
• In a fresh ARM container, installed the package with dependency resolution. ldd reports no missing libraries, cursor --version reports 3.20.21 / arm64, and the bundled Node reports v24.18.1.
• Graphical startup check: a visible Cursor window opens on Xvfb and remains running. Docker blocks user namespaces, so this UI smoke test uses --no-sandbox only in the test invocation. The packaged launchers do not disable sandboxing. Normal desktop sandboxing, GPU/Wayland rendering, authentication, editing and migration from manually installed files remain untested here.
• The existing Cursor release watch reports the recipe current. Shell syntax and git diff --check passed.

Related: #370 (updater policy).