Add Apache 2.0 license and public-release legal notices

[pertschuk]

Legal OSS prep for making this partner worker template public. Mirrors Grok Build as requested by Tina Soppitt (Anysphere/SpaceXAI commercial legal).

Follow-up (Anysphere trademark)

• Added Anysphere to the README trademarks list. Sentence is now: SpaceXAI, Anysphere, Cursor, or Grok.
• LICENSE appendix left verbatim (Copyright [yyyy] [name of copyright owner]). Not filled in.
• Slop scan: no agent comments, stray TODOs, placeholder company names (besides the Apache appendix), or duplicated legal sections.

Tina checklist

• Apache 2.0 instead of MIT. Copied the Apache body from https://raw.githubusercontent.com/xai-org/grok-build/main/LICENSE (byte-identical after the copyright line). Copyright line is Copyright 2026 SpaceXAI (not Anysphere; not Grok Build’s 2023-2026 range).
• README legal block after Related resources: License, Trademarks (SpaceXAI / Anysphere / Cursor / Grok + AWS), and AS IS Disclaimer — wording as specified.
• Scrub internal pin + docs. Removed <!-- REMOVE BEFORE PUBLISHING: internal lab CLI pin. Not for partners. --> and the entire ## REMOVE BEFORE PUBLISHING: Pin a CLI version section. Partner how-to (deploy, pools, AWS + Cursor docs) is unchanged.
• No CONTRIBUTING.md added (not needed).
• No THIRD-PARTY-NOTICES — this tree has no vendored third-party source.

What was scrubbed

Item	Action
MIT LICENSE, Copyright (c) 2026 Anysphere	Replaced with Apache 2.0, Copyright 2026 SpaceXAI
README internal pin section + lab tarball URL + cursor.com/install?channel=lab	Deleted; remaining CLI pointers use public cursor.com/install
Troubleshooting row that told partners to pin microvm-image/cursor-agent-version	Rewritten to the public installer
Lab version 2026.08.21-4bf0f61 in microvm-image/cursor-agent-version	Cleared (comments only → public installer)
Dockerfile comments advertising lab/main CLI pins	Neutralized; empty pin still uses https://cursor.com/install
api2.cursor.sh in microvm-image/entrypoint.sh	Comment now refers to the public REST host api.cursor.com without naming the internal CLI host

Searched, not present (nothing to strip)

• Secrets / hardcoded keys / PEM / .env
• staging.cursor.com, anysphere.slack
• Slack webhooks or internal Slack hosts (README still mentions Slack/GitHub/Linear as public product start channels, which is partner-facing)
• CONTRIBUTING.md

Public AWS docs and cursor.com / cursor.com/docs / api.cursor.com links are kept.

Residual (intentionally left)

Dockerfiles still have an unused optional fetch of downloads.cursor.com/lab/${VERSION}/... if someone later puts a version in cursor-agent-version. The committed pin file is empty, so image builds use the public installer. Not documented as partner instructions.

Test plan

• Confirm LICENSE is Apache 2.0 with Copyright 2026 SpaceXAI
• Confirm README ends with License / Trademarks / Disclaimer and has no REMOVE BEFORE PUBLISHING section
• LICENSE appendix still has Copyright [yyyy] [name of copyright owner]
• Trademarks list includes Anysphere