Add Recon and SubnetRecon mega-test gates after parallel landings.

Wire focused Go/Vitest/E2E slices in test-suite.ps1 and refresh README/PROBLEMS counts for deploy and subnet recon.

PROBLEMS.md

@@ -4,7 +4,7 @@ Open issues only. Fixed items removed. Last sweep: 2026-06-07.
 
 ## No open code issues
 
-Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **901**, agent **657**, Vitest **849**, Playwright **26** — see `tests/README.md`.
+Automatable gaps are closed; remaining items below are by-design limits, architecture deferrals, or manual/live operator work. Regression tables and counts: Go server **1001**, agent **680**, Vitest **867**, Playwright **32** — see `tests/README.md`.
 
 ## By design / safety
 
@@ -89,6 +89,9 @@ Automatable gaps are closed; remaining items below are by-design limits, archite
 | **Cloud venue on live EC2** | IMDS tag inference tested with inject; real `g4dn`/spot/batch labels need AWS instances. |
 | **Onion contingency LLM invoke** | Deterministic persona branch compose in CI; live court LLM on every exhaust tick not automated. |
 | **P2 spread lanes (manual only)** | Live Docker/Podman start; real WinRM/GPO/systemd/crontab on remote hosts; live BITS/curl; live multi-hop discover→spread without Playwright stub. |
+| **Deploy Recon port scan / crawl** | TCP port dial and same-origin HTTP crawl execute on the **dashboard host** (Go server), not from fleet agents. Firewall path must allow the server to reach the owned target. |
+| **Deploy Recon SSRF** | UI copies SSRF probe URLs; **no automated form submit** — operator pastes probe URL into owned target fields manually to validate server-side fetch to install.sh. |
+
 ## Do not commit
 
 - `data/login-credentials.json`, `data/users.json`, and other local secrets.