Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/api/agent_ws_limiter.go

@@ -32,6 +32,9 @@ func allowAgentWSUpgrade(clientIP string) bool {
 			filtered = append(filtered, t)
 		}
 	}
+	if len(filtered) == 0 {
+		delete(agentWSRateLim.attempts, clientIP)
+	}
 	if len(filtered) >= agentWSRateLimitMax {
 		agentWSRateLim.attempts[clientIP] = filtered
 		return false