Release validation: tests green, USB pack, fleet UX and API hardening.

Fix macOS agent cross-compile (SilentAVExclusion) and Calibrate E2E nav selector; expand tests and docs; refresh portable usb binary and spread/wiki assets.

server/web/src/components/Fleet/FleetRuntimePanel.tsx

@@ -5,6 +5,7 @@ import { useWebSocket } from '../../hooks/useWebSocket';
 import { useFleetGroups } from '../../hooks/useFleetGroups';
 import type { FleetModuleManifest } from '../../types';
 import NeonCard from '../NeonCard/NeonCard';
+import { HelpTip } from '../HelpTip';
 import './FleetRuntimePanel.css';
 
 type TargetMode = 'all' | 'group';
@@ -147,7 +148,7 @@ export default function FleetRuntimePanel() {
     <>
       <NeonCard accent="green" className="settings-section fleet-policy-deck operator-deck-card operator-interactive" hud>
         <p className="fleet-policy-eyebrow font-tech">RUNTIME · NO RE-FORGE</p>
-        <h2 className="font-display">Live Fleet Policy</h2>
+        <h2 className="font-display">Live Fleet Policy <HelpTip field="fleet_runtime_policy" /></h2>
         <p className="section-desc">
           Push live mining rules to connected workers — schedule, CPU cap, and optional pool overrides apply in memory
           via <code className="mono-sm">policy_update</code>. Identity and baked forge options stay on the binary; this
@@ -376,7 +377,7 @@ export default function FleetRuntimePanel() {
       </NeonCard>
 
       <NeonCard accent="magenta" className="settings-section fleet-module-deck operator-deck-card operator-interactive">
-        <h2 className="font-display">Push Module to Fleet</h2>
+        <h2 className="font-display">Push Module to Fleet <HelpTip field="fleet_runtime_modules" /></h2>
         <p className="section-desc">
           Stage signed feature packs from <code className="mono-sm">data/modules/</code> — agents fetch via{' '}
           <code className="mono-sm">GET /api/v1/agent/module/&#123;name&#125;</code> and enable flags without a full