Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/internal/scheduler/fleet_scheduler.go

@@ -82,14 +82,28 @@ func (s *FleetScheduler) tickInterval() {
 		return
 	}
 	agentIDs := s.send.ConnectedAgentIDs()
+
+	// Collect IDs of interval tasks so we can bulk-fetch last-run timestamps
+	// in a single query instead of one query per (task, agent) pair.
+	var taskIDs []string
+	for _, t := range tasks {
+		if t.Enabled && t.Trigger == "interval_hours" && t.IntervalHours > 0 {
+			taskIDs = append(taskIDs, t.ID)
+		}
+	}
+	lastRuns, err := s.db.BulkLastFleetTaskRuns(agentIDs, taskIDs)
+	if err != nil {
+		log.Printf("[scheduler] bulk last runs: %v", err)
+		return
+	}
+
 	for _, t := range tasks {
 		if !t.Enabled || t.Trigger != "interval_hours" || t.IntervalHours <= 0 {
 			continue
 		}
 		interval := time.Duration(t.IntervalHours * float64(time.Hour))
 		for _, agentID := range agentIDs {
-			last, ok := s.db.LastFleetTaskRun(agentID, t.ID)
-			if ok && time.Since(last) < interval {
+			if last, ok := lastRuns[agentID+":"+t.ID]; ok && time.Since(last) < interval {
 				continue
 			}
 			s.dispatchTask(agentID, t)