Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/cloudflared/launcher_stub_test.go

@@ -0,0 +1,12 @@
+//go:build !windows
+
+package cloudflared
+
+import "testing"
+
+func TestStubStartStop(t *testing.T) {
+	if err := Start("", "", "token-should-not-matter"); err != nil {
+		t.Fatalf("Start: %v", err)
+	}
+	Stop()
+}

server/internal/cloudflared/launcher_windows.go

@@ -15,6 +15,8 @@ import (
 	"syscall"
 )
 
+const maxCloudflaredBinaryBytes = 100 * 1024 * 1024 // 100 MB sanity cap
+
 const downloadURL = "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe"
 
 var (
@@ -121,7 +123,7 @@ func ensureBinary(deckRoot string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	_, err = io.Copy(f, resp.Body)
+	_, err = io.Copy(f, io.LimitReader(resp.Body, maxCloudflaredBinaryBytes))
 	closeErr := f.Close()
 	if err != nil {
 		return "", err

server/internal/cloudflared/launcher_windows_test.go

@@ -0,0 +1,17 @@
+//go:build windows
+
+package cloudflared
+
+import "testing"
+
+func TestStartEmptyTokenIsNoOp(t *testing.T) {
+	for _, token := range []string{"", "  ", "\t", `""`, "''"} {
+		if err := Start("", "", token); err != nil {
+			t.Fatalf("Start(%q): %v", token, err)
+		}
+	}
+}
+
+func TestStopWhenNotRunning(t *testing.T) {
+	Stop()
+}