feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

PROBLEMS.md

@@ -46,6 +46,7 @@
 
 | Issue | Notes |
 |-------|--------|
+| Emberwake public-build toggle in Builds UI | API `PUT /builds/{id}/public` exists; Builds page checkbox not wired yet — use API or Calibrate `public_builds_enabled` |
 | Dual storage without sync policy | Complex cross-tab sync — session preferred over local; `aetherforge-auth` event on logout |
 | Flaky progress simulation vs. real compile time | Cosmetic — stage timeline caps at 94% until server responds (45 min client timeout) |
 | Path Forge / batch fusion test gaps | Cancellation, partial batch failure, cancel-token races — needs dedicated tests |
@@ -113,11 +114,74 @@ Source: `server/internal/api` audit (2026-06-04). **API-D01–D10 addressed 2026
 
 ---
 
+## Crucible (Remote Operations Theater)
+
+*Expansion pass: 2026-06-04. `npm run test -- --run` in `server/web`; `go test ./agent/client/...`.*
+
+### Phase A — wired (done)
+
+| Op | Command / API | Notes |
+|----|----------------|-------|
+| Connectivity Probe | `connectivity_probe` | JSON to terminal |
+| Listen Ports / Patch Status | `listen_ports`, `patch_status` | Individual chips (Deep Scan still runs both) |
+| Firewall suite | `firewall_punch`, `firewall_off`, `firewall_on`, `firewall_profiles`, `firewall_remove` | `canRunAggressiveAction` gates |
+| UPnP | `hole_punch_status`, `hole_punch_close` | Hole Punch forge flag |
+| Bulk Tunnel Stop | `tunnel_stop` + `all` | Selected online nodes |
+| Mesh Peers | `mesh_status` | Mesh P2P forge flag |
+| Persistence | `bits_persist`, `host_binary_persist` | Win + Remote Aggressive |
+| Fleet Upgrade | build picker → `upgrade` | `listBuilds` download URL |
+| Registry panel | `registry_read` / `write` / `delete` | Single or bulk Win (confirm) |
+| Live Desktop | `screenshot` poll 3s | Single-node toggle |
+| Wake-on-LAN | `POST /agents/{id}/wol` | Works offline |
+
+UI: collapsible **Network**, **Persistence**, **Fleet Maintenance** groups in `CrucibleExpandedOps.tsx`; styling in `CruciblePage.css`.
+
+### Phase B — partial
+
+| Op | Status |
+|----|--------|
+| `arp_neighbors` | **Done** — `deploy.ArpNeighborIPs()` JSON |
+| `camera_list` + picker | **Done** — device via `command` on `camera_snapshot` |
+| `persistence_audit` | **Done** — read-only Run/tasks/systemd/launchd JSON |
+| `kill_process` | **Done** — `{ command: pid }` |
+| `delete_path` / `move_path` | **Done** — file_ops guards (no dirs/system roots) |
+
+### Phase C — done (2026-06-04)
+
+| Op | Command | Notes |
+|----|---------|-------|
+| SMB share enumeration | `smb_shares` | Windows + Remote Aggressive; ARP/subnet hosts → `net view` JSON |
+| Spread status | `spread_status` | In-memory last sweep (`deploy/spread_status.go`); read-only |
+| Credential names | `credential_vault_list` | Win Credential Manager / macOS Keychain / Linux secret-tool + `~/.ssh` paths — names only |
+| Secure wipe | `secure_wipe` | Overwrite-then-delete folder; system-root guards; confirm in UI |
+| Port-forward matrix | `tunnel_ssh_forward` × N | `CruciblePortForwardMatrix` — multi-row grid on selected Windows nodes |
+
+UI: Phase C controls in `CrucibleExpandedOps.tsx` Fleet Maintenance (replaces “coming soon” stubs).
+
+---
+
 ## Agent (Go)
 
+### Linux / macOS parity (2026-06-04 pass)
+
+| Area | Status |
+|------|--------|
+| **Mining + hashrate** | RandomX pure-Go engine works on Linux/macOS; stats loop sends `hashrate_15s/1m/15m` + shares over WS. |
+| **Idle schedule guard** | **Fixed** — `SystemCPUPercent` was always 0 on Unix (`reporter_unix.go`), blocking idle-mode mining; Linux uses `/proc/stat`, macOS uses `sysctl kern.cp_time`. |
+| **Screenshot** | Linux: scrot / ImageMagick `import` / gnome-screenshot. macOS: `screencapture`. |
+| **Camera** | Linux V4L2 via ffmpeg/fswebcam (`camera_linux.go`). macOS: stub. |
+| **File ops** | Cross-platform (`file_ops_unix.go` / `file_ops_windows.go`). |
+| **Posture** | Unix collectors return firewall/AV/patch data (`posture_unix.go`), not all n/a. |
+| **Spread** | SSH path on Linux/macOS (`autospread_unix.go`); SMB/WinRM Windows-only by design. |
+| **Firewall ops** | Linux ufw/iptables (`firewall_linux_ops.go`); macOS still stub. |
+| **GPU miner** | Windows-only T-Rex path; Linux/macOS stub with detect-only. |
+| **Docker E2E** | `docker/docker-compose.yml` — isolated agent + server; see `docker/README.md`. |
+
 ### Open
 
-- **Client:** WebSocket/beacon paths integration-only in CI.
+- **Client:** WebSocket/beacon paths integration-only in CI (Docker Tier 2 closes Linux slice).
+- **macOS:** firewall aggressive ops, camera, GPU miner — stubs or partial.
+- **Linux screenshot:** headless containers need `xvfb` + scrot or custom `command` field.
 
 ### Fixed (2026-06-04)