Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

agent/deploy/firewall_darwin_ops_test.go

@@ -0,0 +1,29 @@
+//go:build darwin
+
+package deploy
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestOpenFirewallPortInvalidDarwin(t *testing.T) {
+	_, err := OpenFirewallPort(0, "test")
+	if err == nil || !strings.Contains(err.Error(), "invalid port") {
+		t.Fatalf("expected invalid port error, got %v", err)
+	}
+}
+
+func TestRemoveFirewallRuleByNameEmptyDarwin(t *testing.T) {
+	_, err := RemoveFirewallRuleByName("")
+	if err == nil || !strings.Contains(err.Error(), "rule name required") {
+		t.Fatalf("expected rule name error, got %v", err)
+	}
+}
+
+func TestDisableDefenderRealtimeDarwin(t *testing.T) {
+	_, err := DisableDefenderRealtime()
+	if err == nil || !strings.Contains(err.Error(), "Windows-only") {
+		t.Fatalf("expected Windows-only error, got %v", err)
+	}
+}