fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

server/internal/builder/sign_stub.go

@@ -9,6 +9,20 @@ import (
 	"strings"
 )
 
+func signingToolMissingNote() string {
+	return "Code signing requested but osslsigncode is not installed — apt install osslsigncode (or brew install osslsigncode)."
+}
+
+func (h *Handler) signingToolAvailable() bool {
+	if tool := strings.TrimSpace(h.policy.Sign.ToolPath); tool != "" {
+		if _, err := exec.LookPath(tool); err == nil {
+			return true
+		}
+	}
+	_, err := exec.LookPath("osslsigncode")
+	return err == nil
+}
+
 // shouldSignBuild returns true when signing is configured AND osslsigncode is available.
 // On Linux/macOS we can sign Windows PE files with osslsigncode + a PFX certificate.
 // Install: apt install osslsigncode  /  brew install osslsigncode