Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/db/fleet_tasks.go

@@ -2,6 +2,8 @@ package db
 
 import (
 	"database/sql"
+	"fmt"
+	"strings"
 	"time"
 
 	"crypto-miner-server/internal/models"
@@ -71,6 +73,42 @@ func (d *Database) LastFleetTaskRun(agentID, taskID string) (time.Time, bool) {
 	return ts, true
 }
 
+// BulkLastFleetTaskRuns returns a map keyed by "agentID:taskID" with the
+// last_run_at time for every matching row.  Missing pairs were never run.
+// A single query replaces O(tasks × agents) individual lookups.
+func (d *Database) BulkLastFleetTaskRuns(agentIDs, taskIDs []string) (map[string]time.Time, error) {
+	if len(agentIDs) == 0 || len(taskIDs) == 0 {
+		return map[string]time.Time{}, nil
+	}
+	args := make([]interface{}, 0, len(agentIDs)+len(taskIDs))
+	for _, id := range agentIDs {
+		args = append(args, id)
+	}
+	for _, id := range taskIDs {
+		args = append(args, id)
+	}
+	query := fmt.Sprintf(
+		`SELECT agent_id, task_id, last_run_at FROM fleet_task_runs WHERE agent_id IN (%s) AND task_id IN (%s)`,
+		strings.Repeat("?,", len(agentIDs)-1)+"?",
+		strings.Repeat("?,", len(taskIDs)-1)+"?",
+	)
+	rows, err := d.Query(query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := make(map[string]time.Time, len(agentIDs)*len(taskIDs))
+	for rows.Next() {
+		var agentID, taskID string
+		var ts time.Time
+		if err := rows.Scan(&agentID, &taskID, &ts); err != nil {
+			return nil, err
+		}
+		out[agentID+":"+taskID] = ts
+	}
+	return out, rows.Err()
+}
+
 func scanFleetTaskRow(row *sql.Row) (*models.FleetTask, error) {
 	t := &models.FleetTask{}
 	var enabled int