Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/db/sqlite.go

@@ -28,6 +28,9 @@ func New(dataDir string) (*Database, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to open database: %w", err)
 	}
+	// SQLite only supports one concurrent writer; a single open connection
+	// avoids WAL write-lock contention and SQLITE_BUSY under load.
+	db.SetMaxOpenConns(1)
 
 	d := &Database{db}
 	if err := d.migrate(); err != nil {
@@ -309,6 +312,9 @@ func (d *Database) ListAgents() ([]*models.Agent, error) {
 		}
 		agents = append(agents, a)
 	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
 	return agents, nil
 }
 
@@ -347,6 +353,9 @@ func (d *Database) GetRecentShares(limit int) ([]*models.Share, error) {
 		s.Accepted = accepted == 1
 		shares = append(shares, s)
 	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
 	return shares, nil
 }
 
@@ -376,6 +385,9 @@ func (d *Database) GetHashrateHistory(agentID string, limit int) ([]*models.Hash
 		}
 		samples = append(samples, s)
 	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
 	return samples, nil
 }
 
@@ -464,26 +476,32 @@ func (d *Database) GetLatestBuildForPlatform(platform string) (*models.BuildReco
 // SetPinnedBuild unpins all builds then pins the one with the given id.
 // If id is empty, all builds are unpinned. Returns an error when id is
 // non-empty but no build row matches (avoids leaving all builds unpinned).
+// Both UPDATEs run in a single transaction so a crash mid-way cannot leave
+// the table in a half-pinned state.
 func (d *Database) SetPinnedBuild(id string) error {
-	_, err := d.Exec(`UPDATE builds SET pinned = 0`)
+	tx, err := d.Begin()
 	if err != nil {
 		return err
 	}
-	if id == "" {
-		return nil
-	}
-	res, err := d.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
-	if err != nil {
+	defer tx.Rollback() //nolint:errcheck
+
+	if _, err := tx.Exec(`UPDATE builds SET pinned = 0`); err != nil {
 		return err
 	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return err
+	if id != "" {
+		res, err := tx.Exec(`UPDATE builds SET pinned = 1 WHERE id = ?`, id)
+		if err != nil {
+			return err
+		}
+		n, err := res.RowsAffected()
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return fmt.Errorf("build not found: %s", id)
+		}
 	}
-	if n == 0 {
-		return fmt.Errorf("build not found: %s", id)
-	}
-	return nil
+	return tx.Commit()
 }
 
 func (d *Database) ListBuilds(limit int) ([]*models.BuildRecord, error) {
@@ -501,6 +519,9 @@ func (d *Database) ListBuilds(limit int) ([]*models.BuildRecord, error) {
 		}
 		builds = append(builds, b)
 	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
 	return builds, nil
 }