A critical Cursor IDE flaw runs a fake git.exe the moment you open a repo, no click needed. Still unpatched after 7 months. Here's what to do about it.