Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

agent/client/silent_windows_test.go

@@ -0,0 +1,54 @@
+//go:build windows
+
+package client
+
+import "testing"
+
+func TestSilentCombinedOutputEcho(t *testing.T) {
+	out, err := silentCombinedOutput("cmd", "/c", "echo hello")
+	if err != nil {
+		t.Fatalf("silentCombinedOutput: %v", err)
+	}
+	if string(out) != "hello\r\n" && string(out) != "hello\n" {
+		t.Errorf("got %q, want hello with newline", string(out))
+	}
+}
+
+func TestSilentOutputEcho(t *testing.T) {
+	out, err := silentOutput("cmd", "/c", "echo world")
+	if err != nil {
+		t.Fatalf("silentOutput: %v", err)
+	}
+	if string(out) != "world\r\n" && string(out) != "world\n" {
+		t.Errorf("got %q, want world with newline", string(out))
+	}
+}
+
+func TestSilentRunTrue(t *testing.T) {
+	if err := silentRun("cmd", "/c", "exit 0"); err != nil {
+		t.Errorf("silentRun(true): %v", err)
+	}
+}
+
+func TestSilentRunFalse(t *testing.T) {
+	err := silentRun("cmd", "/c", "exit 1")
+	if err == nil {
+		t.Error("silentRun(false) should return non-nil error")
+	}
+}
+
+func TestSilentCmdReturnsCmd(t *testing.T) {
+	cmd := silentCmd("cmd", "/c", "echo hi")
+	if cmd == nil {
+		t.Fatal("silentCmd returned nil")
+	}
+	if cmd.Path == "" {
+		t.Error("silentCmd returned cmd with empty Path")
+	}
+}
+
+func TestSilentStart(t *testing.T) {
+	if err := silentStart("cmd", "/c", "exit 0"); err != nil {
+		t.Fatalf("silentStart: %v", err)
+	}
+}