Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/builder/pathforge.go

@@ -91,6 +91,12 @@ func (h *PathForgeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "root_path is required", http.StatusBadRequest)
 		return
 	}
+	cleanRoot, err := h.validateRootPath(req.RootPath)
+	if err != nil {
+		http.Error(w, "root_path rejected: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+	req.RootPath = cleanRoot
 	if !req.TargetWindows && !req.TargetMac {
 		req.TargetWindows = true
 		req.TargetMac = true