test(cursor-image): thread peerLocality through the flag-shaped-model test

The model-allowlist test (from the allowlist/timeout-clamp commit) and the
loopback/LAN guard (from the security-guard commit) were written independently
against diverging histories of this PR and didn't know about each other —
cherry-picking both here exposed the gap: this one test still called
handleCursorAgentImageGeneration without peerLocality, so the guard's
fail-closed default rejected it with 403 before reaching the argv-sanitization
logic the test actually exercises.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

tests/unit/cursor-agent-image.test.ts

@@ -268,6 +268,7 @@ test("handleCursorAgentImageGeneration never forwards a flag-shaped model into C
       providerSpecificData: { agentBin: process.execPath },
     },
     spawnImpl: fakeSpawn,
+    peerLocality: "loopback",
   });
 
   assert.equal(result.success, true);