feat(acp): move six pinned agent CLIs to their current releases

Kimi Code 0.40.1 to 0.41.0, CodeBuddy 2.143.0 to 2.144.0, Qoder 1.1.41 to
1.1.44, Cursor 2026.08.31-4057e58 to 2026.09.02-c22c1a3, Antigravity 1.0.0 to
1.1.1, OpenCode 1.18.26 to 1.18.29. Every launch contract the registry encodes
still holds under the new pins: `--acp` remains a registered option on CodeBuddy
and Qoder, and each npm package's declared `engines.node` still matches its
`node_required` floor.

Antigravity's download URLs no longer carry a build id. Google renamed the
archives after the release itself and back-published the old build as
`agy_acp_server_1.0.0`, so the pinned version now templates into the URL and
`supports_custom_version()` answers true for the agent: the settings page offers
the control, and a version that was never published (1.0.1) fails the download
instead of caching the same bytes under a number that was never fetched. That
leaves no built-in agent with an untemplatable URL, so the rule keeps its
coverage through a synthetic registry entry in the tests rather than a real one.
The archive is unchanged in shape — still flat, still `agy_acp_server.par`
beside the `localharness_external` the server execs. 1.1.2 is published for
macOS arm64 alone, so it is deliberately not adopted.

Kimi stays clear of the 0.37.0-0.38.0 hole, where any stdio MCP server killed
the session outright: its converter still reads an absent transport as stdio and
supplies the runtime_id itself, so the codeg-mcp companion rides every session,
and the throw that broke those releases is nowhere in the bundle. Cursor's six
release paths all resolve and the tree still carries `dist-package/cursor-agent`
beside its bundled Node, so whole-tree extraction stays correct. OpenCode
publishes all six pinned platform assets under the new tag and each archive
still holds a bare `opencode`, so `dir_entry` stays `None`.

Qoder's config-dir resolver keeps its precedence, keys and `.qoder` default
beneath renamed minified identifiers, and Kimi's mcp.json schema is unchanged
beneath the new pins; the comments mirroring both now name the version they were
last checked against.