ci: use CURSOR_PREFERRED_MODEL secret instead of hardcoded model

[masnwilliams]

Summary

Replaces the hardcoded --model opus-4.5 in the cursor-agent CLI invocation in .github/workflows/fix-ci.yaml with --model ${{ secrets.CURSOR_PREFERRED_MODEL }}, allowing the model to be configured via GitHub Actions secrets instead of requiring a code change.

---

Note

Low Risk
Low risk workflow-only change that just swaps a hardcoded model name for a configurable secret; main risk is misconfiguration if the secret is unset or invalid.

Overview
Updates the Fix CI Failures GitHub Actions workflow to stop hardcoding the cursor-agent --model value and instead read it from ${{ secrets.CURSOR_PREFERRED_MODEL }} for configurable model selection without code changes.

^{Written by Cursor Bugbot for commit c61cac1. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Missing secret causes model flag to consume next argument

Medium Severity

If the CURSOR_PREFERRED_MODEL secret is not configured (or is empty), ${{ secrets.CURSOR_PREFERRED_MODEL }} resolves to an empty string. The shell would then parse --model --force, causing --force to be consumed as the model name. Unlike the other secrets in this workflow (which fail clearly at their respective steps), this would produce a confusing error from cursor-agent. Adding a default fallback like ${{ secrets.CURSOR_PREFERRED_MODEL || 'opus-4.5' }} would preserve the previous behavior when the secret is unset.