Fix Fleet AI and LOTL test regressions after parallel merges.

Stub slow syscheck/listen-port probes in agent tests, fix ai_snapshot mutex deadlock, reorder fleet clearance vs connectivity checks, and add AI control precedence plus LotlTimeline vitest coverage.

server/internal/api/fleet_handler.go

@@ -386,6 +386,15 @@ func (f *FleetHandler) PostAgentCommand(w http.ResponseWriter, r *http.Request)
 		http.Error(w, "websocket hub unavailable", http.StatusServiceUnavailable)
 		return
 	}
+	if id != "all" && !f.ws.IsAgentReachable(id) {
+		writeJSON(w, map[string]interface{}{
+			"success":  false,
+			"error":    "agent not connected",
+			"agent_id": id,
+			"action":   req.Action,
+		})
+		return
+	}
 	if id != "all" {
 		level := clearance.L0
 		if mgr := f.ws.ClearanceManager(); mgr != nil {
@@ -428,15 +437,6 @@ func (f *FleetHandler) PostAgentCommand(w http.ResponseWriter, r *http.Request)
 		}
 		f.ws.BroadcastAgentCommand(req.Action, args)
 	} else {
-		if !f.ws.IsAgentReachable(id) {
-			writeJSON(w, map[string]interface{}{
-				"success":  false,
-				"error":    "agent not connected",
-				"agent_id": id,
-				"action":   req.Action,
-			})
-			return
-		}
 		queued = !f.ws.isAgentConnected(id)
 		if err := f.ws.SendAgentCommand(id, req.Action, args); err != nil {
 			writeJSON(w, map[string]interface{}{