Fix Fleet AI and LOTL test regressions after parallel merges.

Stub slow syscheck/listen-port probes in agent tests, fix ai_snapshot mutex deadlock, reorder fleet clearance vs connectivity checks, and add AI control precedence plus LotlTimeline vitest coverage.

server/internal/api/strategy_auth_test.go

@@ -52,6 +52,38 @@ func TestAuthResponseIncludesAdaptiveStrategy(t *testing.T) {
 	}
 }
 
+func TestAuthResponseOmitsAdaptiveStrategyWhenAIControlEnabled(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+
+	hub := NewWSHub(database)
+	hub.SetFleetSecret("test-secret")
+	hub.SetAdaptiveEngine(strategy.NewAdaptiveEngine(database, true))
+	hub.SetServerPolicy(ServerPolicy{AIControlEnabled: true})
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id": "agent-ai-1", "fleet_secret": "test-secret",
+		"wallet": "4" + repeatChar('B', 94), "hostname": "win-docker", "platform": "windows", "version": "test",
+	})
+	if resp.Type != "auth_response" {
+		t.Fatalf("expected auth_response, got %q", resp.Type)
+	}
+	var payload map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload["success"] != true {
+		t.Fatalf("auth failed: %v", payload["error"])
+	}
+	if _, ok := payload["adaptive_strategy"]; ok {
+		t.Fatal("adaptive_strategy must be omitted when ai_control_enabled is true")
+	}
+}
+
 func repeatChar(c byte, n int) string {
 	buf := make([]byte, n)
 	for i := range buf {