Fix Cursor driver inactive account detection

Cursor's Admin API exposes two independent removal signals: the isRemoved
boolean and a role value of "removed". They are not always consistent —
a member can carry role "removed" while isRemoved is still false, a known
gap documented on the Cursor community forum.

Previously Active was derived from isRemoved alone, so a member with
role "removed" but isRemoved=false was incorrectly reported as active.
Now either signal is sufficient to mark the account inactive.

Add a cassette entry and test case covering the inconsistent state
(role "removed", isRemoved false) to prevent regression.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/accessreview/drivers/cursor_test.go

@@ -35,7 +35,7 @@ func TestCursorDriver(t *testing.T) {
 	driver := NewCursorDriver(client)
 	records, err := driver.ListAccounts(context.Background())
 	require.NoError(t, err)
-	require.Len(t, records, 3)
+	require.Len(t, records, 4)
 
 	member := records[0]
 	assert.Equal(t, "jane@example.com", member.Email)
@@ -61,6 +61,15 @@ func TestCursorDriver(t *testing.T) {
 	assert.False(t, removed.IsAdmin)
 	require.NotNil(t, removed.Active)
 	assert.False(t, *removed.Active)
+
+	// Cursor's two removal signals are not always consistent: a member can
+	// carry role "removed" while isRemoved is still false. The role alone
+	// must mark the account inactive.
+	removedByRole := records[3]
+	assert.Equal(t, "Removed", removedByRole.Role)
+	assert.False(t, removedByRole.IsAdmin)
+	require.NotNil(t, removedByRole.Active)
+	assert.False(t, *removedByRole.Active)
 }
 
 func TestCursorRole(t *testing.T) {